CVE-2026-41253: iTerm2 Remote Code Execution Vulnerability

CVE-2026-41253 Overview

A code execution vulnerability exists in iTerm2 through version 3.6.9 that can be triggered when displaying a .txt file. The vulnerability exploits DCS 2000p and OSC 135 escape sequences, which are part of the SSH conductor protocol. When the working directory contains a maliciously crafted file with a name matching valid output from the conductor encoding path (such as a pathname beginning with ace/c+), arbitrary code execution can occur. This is referred to as "hypothetical in-band signaling abuse."

The core issue stems from iTerm2 accepting SSH conductor protocol commands from terminal output even when the output does not originate from a legitimate conductor session, allowing attackers to craft malicious terminal sequences that trigger unintended behavior.

Critical Impact

Attackers can achieve code execution on macOS systems running vulnerable versions of iTerm2 by tricking users into displaying malicious text files or navigating to directories containing specially crafted filenames.

Affected Products

• iTerm2 versions through 3.6.9

Discovery Timeline

• 2026-04-18 - CVE CVE-2026-41253 published to NVD
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-41253

Vulnerability Analysis

This vulnerability falls under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The SSH conductor protocol in iTerm2 uses Device Control String (DCS) and Operating System Command (OSC) escape sequences to enable advanced integration features between the terminal and remote SSH sessions.

The fundamental flaw is a lack of proper origin validation for these escape sequences. iTerm2's conductor protocol handler processes DCS 2000p and OSC 135 sequences without verifying whether they originate from an authenticated conductor session. This means that any terminal output—including content from simple text files—can inject conductor protocol commands.

When a user runs a command like cat readme.txt in a directory containing a file with a specially crafted name (beginning with patterns like ace/c+ that match the conductor encoding scheme), the terminal output can be interpreted as conductor protocol commands. This in-band signaling abuse allows an attacker to execute arbitrary code within the context of the terminal session.

Root Cause

The root cause is improper trust boundary enforcement in iTerm2's escape sequence processing. The conductor protocol was designed for legitimate SSH integration but lacks authentication mechanisms to verify that incoming protocol messages originate from an actual conductor session rather than arbitrary terminal output. This violates the principle of least privilege by granting untrusted input the same processing authority as authenticated protocol messages.

Attack Vector

The attack requires local access and relies on social engineering or file system manipulation. An attacker must place a maliciously named file in a directory that the victim will access, or convince the victim to display a text file containing the malicious escape sequences. The attack complexity is considered high because it requires specific conditions:

1. The victim must be using a vulnerable version of iTerm2 (through 3.6.9)
2. The victim must display content (via cat, less, or similar commands) that contains the malicious escape sequences
3. Alternatively, directory listing operations may trigger the vulnerability if filenames are crafted appropriately

The vulnerability does not require user interaction beyond normal terminal usage, as standard operations like viewing files or listing directories can trigger the exploit when malicious content is present.

Detection Methods for CVE-2026-41253

Indicators of Compromise

• Presence of files with unusual names starting with ace/c+ or similar conductor encoding patterns in working directories
• Unexpected process execution traced back to iTerm2 terminal sessions
• Text files containing DCS 2000p or OSC 135 escape sequences in file contents
• Anomalous conductor protocol activity in iTerm2 without active SSH sessions

Detection Strategies

• Monitor file creation events for filenames matching conductor encoding patterns (e.g., paths beginning with ace/c+)
• Implement endpoint detection rules to flag unexpected child processes spawned from iTerm2
• Scan text files in shared or download directories for suspicious escape sequences before viewing
• Review iTerm2 logs for conductor protocol activation when no SSH sessions are active

Monitoring Recommendations

• Deploy file integrity monitoring on macOS endpoints to detect creation of suspicious filenames
• Establish baseline behavior for iTerm2 process trees and alert on deviations
• Implement network monitoring to detect data exfiltration following potential exploitation
• Consider application allowlisting to prevent unauthorized code execution from terminal sessions

How to Mitigate CVE-2026-41253

Immediate Actions Required

• Upgrade iTerm2 to a patched version beyond 3.6.9 immediately
• Review working directories for suspicious files with names matching conductor encoding patterns
• Exercise caution when viewing text files from untrusted sources
• Consider using alternative terminal emulators until patching is complete

Patch Information

A security fix has been committed to the iTerm2 repository. The patch addresses the vulnerability by implementing proper origin validation for SSH conductor protocol commands. Users should download the latest version from the iTerm2 Downloads Page.

The specific fix can be reviewed in the GitHub iTerm2 Commit. This commit introduces validation logic to ensure conductor protocol escape sequences are only processed when they originate from legitimate conductor sessions.

Workarounds

• Avoid using cat or similar commands to display text files from untrusted sources
• Use pagers or editors that do not pass escape sequences directly to the terminal
• Disable iTerm2 shell integration features temporarily if upgrade is not immediately possible
• Review directory contents before navigation to identify suspicious filenames
• Consider piping untrusted file content through sanitization tools that strip escape sequences

For additional technical details on the vulnerability discovery and exploitation mechanics, refer to the California Blog Post which provides comprehensive analysis of the in-band signaling abuse technique.