iTerm2 Flaw Turns SSH Escape Sequences Into Arbitrary Code Execution

Gbhackers •Divya • April 20, 2026

In the cybersecurity community, we often assume that simply reading a text file using a command like cat is a perfectly safe operation. However, security researchers have recently demonstrated that doing so inside the popular iTerm2 macOS terminal emulator can cross the line into arbitrary code execution. This alarming discovery, made in partnership with OpenAI, highlights a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

iTerm2 Vulnerability Enables Remote Code Execution via SSH Escape Sequences Cybersecurity researchers have identified a critical vulnerability in iTerm2, a popular macOS terminal emulator, that exploits the application's SSH integration. This flaw allows attackers to execute arbitrary code on a victim's machine simply by viewing a specially crafted text file. The vulnerability, which has been disclosed in partnership with OpenAI, poses a significant risk to users of iTerm2, particularly those who frequently utilize SSH features. The attack vector relies on SSH escape sequences that can be embedded in text output, leading to local remote code execution (RCE). Users are urged to remain vigilant and monitor for updates regarding this issue. The exact CVE identifier for this vulnerability has not yet been disclosed. The scope of impact is substantial given the widespread use of iTerm2 among developers and system administrators. As of now, no patches have been released to address this vulnerability. 3 sources 62

Extracted Entities

Platforms (2)

ITerm2 MacOS