Critical severity9.8NVD Advisory· Published Jun 16, 2024· Updated Jun 17, 2026

CVE-2024-38395

Description

In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Gnachman/Iterm23 versions
cpe:2.3:a:iterm2:iterm2:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:iterm2:iterm2:*:*:*:*:*:*:*:*range: >=3.5.0,<3.5.2
- (no CPE)
- (no CPE)range: <3.5.2

Patches

Vulnerability mechanics

References

gitlab.com/gnachman/iterm2/-/commit/f1e89f78dd72dcac3ba66d3d6f93db3f7f649219nvdPatch
www.openwall.com/lists/oss-security/2024/06/17/1nvdMailing ListThird Party Advisory
gitlab.com/gnachman/iterm2/-/tags/v3.5.2nvdRelease Notes
iterm2.com/downloads.htmlnvdProduct
www.openwall.com/lists/oss-security/2024/06/15/1nvdMailing List

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000