CVE Feed

    Dashboard / CVE / CVE-2023-46301

    CVE-2023-46301

    iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload.

    Published:Oct 22, 2023
    Last Modified:Nov 21, 2024
    EPS:Oct 22, 2023
    EPSS Score:0.00154
    CVSS Score:9.8

    Affected Products

    Vendor
    Iterm2
    Product
    Iterm2

    Exploits

    https://blog.solidsnail.com/posts/2023-08-28-iterm2-rcehttps://blog.solidsnail.com/posts/2023-08-28-iterm2-rce

    Related CVEs

    CVE-2026-41253 (CVSS 6.9) — In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if th…
    CVE-2025-22275 (CVSS 9.3) — iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information fr…
    CVE-2024-38396 (CVSS 9.8) — An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window …
    CVE-2024-38395 (CVSS 9.8) — In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code ex…
    CVE-2023-46321 (CVSS 9.8) — iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have …
    CVE-2023-46322 (CVSS 9.8) — iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's in…
    CVE-2023-46300 (CVSS 9.8) — iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequen…
    CVE-2022-45872 (CVSS 9.8) — iTerm2 before 3.4.18 mishandles a DECRQSS response.…
    CVE-2019-19022 (CVSS 7.5) — iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.go…
    CVE-2019-9535 (CVSS 9.8) — A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High