CVE-2026-41253 Details
Description
In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file whose name is valid output from the conductor encoding path, such as a pathname with an initial ace/c+ substring, aka "hypothetical in-band signaling abuse." This occurs because iTerm2 accepts the SSH conductor protocol from terminal output that does not originate from a legitimate conductor session.
A code execution vulnerability has been identified in iTerm2 versions through 3.6.9. The issue arises when a .txt file is displayed, allowing for execution of arbitrary code through DCS 2000p and OSC 135 data. This exploitation occurs if the working directory contains a malicious file with a name that can be generated by the conductor encoding path, such as one starting with 'ace/c+'. The vulnerability exists because iTerm2 improperly handles the SSH conductor protocol, accepting unverified data that can trigger code execution.
Users can update to iTerm2 version 3.6.10beta1, which includes a fix for this vulnerability. This beta version can be downloaded from the iTerm2 website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.calif.io/p/mad-bugs-even-cat-readmetxt-is-not | [email protected] | ExploitThird Party Advisory |
| https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30b884a16617cd5495899f86 | [email protected] | Patch |
| https://iterm2.com/downloads.html | [email protected] | Product |
| https://news.ycombinator.com/item?id=47809190 | [email protected] | Issue Tracking |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| iterm2 iterm2 | <= 3.6.9 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| Apr 18, 2026 | New CVE Received | [email protected] |