CVE-2024-38395

The user setting "Terminal may report window title", which should block the ability of the terminal to report the window title, is not actually enforced by the application. A malicious remote webpage can exploit this vulnerability (classified as CWE-94 – improper control of generation of code) to inject and execute arbitrary code on the victim's machine. The attack requires no authentication or user interaction, and access is gained over the network.

An attacker can remotely execute arbitrary code on the victim's system, potentially leading to complete system takeover, data exfiltration, or further lateral movement in the network.

iTerm2 should be updated to version 3.5.2 or later, available at https://iterm2.com/downloads.html. The fix was introduced in commit f1e89f78dd72dcac3ba66d3d6f93db3f7f649219.

iTerm2 versions earlier than 3.5.2