Threat database

CVE-2026-88514 is a medium severity vulnerability in iTerm2 for macOS versions before 3.6.12. It allows a local attacker with low privileges to obtain sensitive information without user interaction. The vulnerability does not affect integrity or availability but impacts confidentiality.

An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in combination with the built-in tmux integration feature (enabled by default), allows an attacker to inject arbitrary code into the terminal, a different vulnerability than CVE-2024-38395.

In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."