Iterm2 EUVD-2026-23656

Exploitation requires: (1) a file with a specially crafted name matching conductor encoding output patterns (containing substrings like 'ace/c+') present in the working directory the user is traversing, (2) the user displaying the contents of or listing files in that directory (using commands like 'cat', 'ls', or file manager operations that echo filenames), and (3) iTerm2 version 3.6.9 or earlier running on the user's macOS system. The attack is further limited by the need for the attacker to have prior write access to the target directory, and by iTerm2's relatively constrained user base compared to other terminal emulators. Exploitation does not require authentication to the target system beyond local file access; it is a privilege-escalation attack that exploits a trusted application's mishandling of protocol sequences.

The CVSS 6.9 score reflects several mitigating factors that reduce practical exploitability: local-only attack vector (AV:L), high complexity (AC:H), and no privilege escalation required (PR:N). However, the vulnerability requires the convergence of multiple conditions: a user must be tricked into displaying or listing files in a directory containing a malicious filename, and that directory must be traversable by the attacker beforehand. The absence of reported active exploitation (no KEV status, no confirmed POC in references) and the high-complexity rating suggest this is a theoretical attack requiring careful setup rather than a trivially exploitable flaw. The real-world risk depends heavily on deployment context - a developer who regularly 'cat' files from untrusted sources (cloned repositories, downloaded archives) faces higher risk than typical users. The fact that this affects common operations ('cat', 'ls' output) that users perform reflexively does elevate concern despite the complexity requirement. CVSS vector AC:H (high complexity) likely accounts for the need to engineer both a malicious filename and convince a user to traverse that directory, but the impact (C:H, I:H, A:L) on code execution confirms this is a real vulnerability, not a false alarm.

An attacker creates a malicious filename in a shared directory (e.g., a cloned Git repository or shared NAS) with a name like 'ace/c+_payload' that, when printed to the terminal via 'cat README.txt' or 'ls -la', contains or triggers DCS/OSC escape sequences. A user, seeing output that includes this filename, inadvertently processes the embedded sequences through iTerm2's protocol parser, causing arbitrary code execution in the terminal's context. No user action beyond viewing the file listing is required if the escape sequences are triggered by the filename itself during display.