iterm2 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
過去の問題は主に vendor risk cross-site scripting and パス処理の欠陥 などに関し、一部は ファイル上書き を招き、vendor surface software deployment and vendor surface production workloads 関連の場面に影響します。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2026-41253 | In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file whose name is valid output from the conductor encoding path, such as a pathname with an initial ace/c+ substring, aka "hypothetical in-band signaling abuse." This occurs because iTerm2 accepts the SSH conductor protocol from terminal output that does not originate from a legitimate conductor session. | [email protected] | 6.9 | 0.20% | 2026-04-18 | 2026-05-18 |
| CVE-2025-22275 | iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from terminal commands by reading the /tmp/framer.txt file. This can occur for certain it2ssh and SSH Integration configurations, during remote logins to hosts that have a common Python installation. | [email protected] | 9.3 | 0.49% | 2025-01-03 | 2025-06-20 |
| CVE-2024-38396 | An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in combination with the built-in tmux integration feature (enabled by default), allows an attacker to inject arbitrary code into the terminal, a different vulnerability than CVE-2024-38395. | [email protected] | 9.8 | 1.70% | 2024-06-16 | 2025-06-20 |
| CVE-2024-38395 | In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable." | [email protected] | 9.8 | 1.50% | 2024-06-16 | 2025-06-18 |
| CVE-2023-46322 | iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's initial character may be non-alphanumeric. The hostname's other characters may be outside the set of alphanumeric characters, dash, and period. | [email protected] | 9.8 | 0.66% | 2023-10-23 | 2024-11-21 |
| CVE-2023-46321 | iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell metacharacters for a /usr/bin/man command line. | [email protected] | 9.8 | 0.66% | 2023-10-23 | 2024-11-21 |
| CVE-2023-46301 | iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload. | [email protected] | 9.8 | 1.18% | 2023-10-22 | 2024-11-21 |
| CVE-2023-46300 | iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to tmux integration. | [email protected] | 9.8 | 1.18% | 2023-10-22 | 2024-11-21 |
| CVE-2022-45872 | iTerm2 before 3.4.18 mishandles a DECRQSS response. | [email protected] | 9.8 | 0.88% | 2022-11-23 | 2025-04-25 |
| CVE-2019-19022 | iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git repositories. | [email protected] | 7.5 | 1.42% | 2019-11-17 | 2024-11-21 |
| CVE-2019-9535 | A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker to execute arbitrary commands by providing malicious output to the terminal. This affects versions of iTerm2 up to and including 3.3.5. This vulnerability may allow an attacker to execute arbitrary commands on their victim's computer by providing malicious output to the terminal. It could be exploited using command-line utilities that print attacker-controlled content. | [email protected] | 9.8 | 2.48% | 2019-10-09 | 2024-11-21 |
| CVE-2015-9231 | iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new (default) feature was added to iTerm2 version 3.0.0 (and unreleased 2.9.x versions such as 2.9.20150717) that resulted in a potential information disclosure. In an attempt to see whether the text under the cursor (or selected text) was a URL, the text would be sent as an unencrypted DNS query. This has the potential to result in passwords and other sensitive information being sent in cleartext wit | [email protected] | 7.5 | 2.23% | 2017-09-20 | 2026-05-13 |