CVE-2026-41253

HIGH EPSS 9.8%
Published Apr 18, 20262mo ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published Apr 18, 2026 2mo ago
Last Modified Jun 17, 2026 2w ago

Description

In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file whose name is valid output from the conductor encoding path, such as a pathname with an initial ace/c+ substring, aka "hypothetical in-band signaling abuse." This occurs because iTerm2 accepts the SSH conductor protocol from terminal output that does not originate from a legitimate conductor session.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
9.8% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-829

Affected Products 1

VendorProductVersionRange
iterm2iterm2* ≤3.6.9

References 4

  • blog.calif.io https://blog.calif.io/p/mad-bugs-even-cat-readmetxt-is-not
    ExploitThird Party Advisory
  • github.com https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30b884a16617cd5495899f86
    Patch
  • iterm2.com https://iterm2.com/downloads.html
    Product
  • news.ycombinator.com https://news.ycombinator.com/item?id=47809190
    Issue Tracking

Remediation

  • github.com https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30b884a16617cd5495899f86
    Patch