CVE-2019-9535
iTerm2, up to and including version 3.3.5, with tmux integration is vulnerable to remote command execution
- Published
- Updated
- Reserved
- Assigned by
- certcc
Description
A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker to execute arbitrary commands by providing malicious output to the terminal. This affects versions of iTerm2 up to and including 3.3.5. This vulnerability may allow an attacker to execute arbitrary commands on their victim's computer by providing malicious output to the terminal. It could be exploited using command-line utilities that print attacker-controlled content.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 2.5% · top 15% of all CVEs (5 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Weakness
Affected products
What to do
Workaround: Update iTerm2 to version 3.3.6, which includes mitigations against exploitation of this vulnerability.
References (3)
- VU#763073 (opens in a new tab)third-party-advisoryx_refsource_CERT-VNx_transferred
- https://blog.mozilla.org/security/2019/10/09/iterm2-critical-issue-moss-audit/ (opens in a new tab)x_refsource_MISCx_transferred
- https://groups.google.com/forum/#%21topic/iterm2-discuss/57k_AuLdQa4 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-9535)Record last updated .