CVE Feed

    Dashboard / CVE / CVE-2024-38395

    CVE-2024-38395

    In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."

    Published:Jun 16, 2024
    Last Modified:Jun 18, 2025
    EPS:Jun 16, 2024
    EPSS Score:0.09714
    CVSS Score:9.8

    Affected Products

    Vendor
    Iterm2
    Product
    Iterm2

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-41253 (CVSS 6.9) — In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if th…
    CVE-2025-22275 (CVSS 9.3) — iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information fr…
    CVE-2024-38396 (CVSS 9.8) — An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window …
    CVE-2023-46321 (CVSS 9.8) — iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have …
    CVE-2023-46322 (CVSS 9.8) — iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's in…
    CVE-2023-46300 (CVSS 9.8) — iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequen…
    CVE-2023-46301 (CVSS 9.8) — iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequen…
    CVE-2022-45872 (CVSS 9.8) — iTerm2 before 3.4.18 mishandles a DECRQSS response.…
    CVE-2019-19022 (CVSS 7.5) — iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.go…
    CVE-2019-9535 (CVSS 9.8) — A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High