PatchSiren

iTerm2 CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM iTerm2 CVE published 2026-04-18

CVE-2026-41253

A vulnerability in iTerm2 through version 3.6.9 allows code execution when displaying a .txt file containing malicious terminal escape sequences. The issue stems from iTerm2's acceptance of SSH conductor protocol data (specifically DCS 2000p and OSC 135 sequences) from terminal output that does not originate from a legitimate conductor session. An attacker can exploit this if the working directory contain [truncated]