CVE-2024-38396

2024-06-1600:00:00

mitre

www.cve.org

iterm2

arbitrary code injection

escape sequence

EPSS

Percentile

15.5%

JSON

An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in combination with the built-in tmux integration feature (enabled by default), allows an attacker to inject arbitrary code into the terminal, a different vulnerability than CVE-2024-38395.