CVE-2023-46322 | BDVDB-2026-214801 Detail

iterm2iterm2

Description#

iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's initial character may be non-alphanumeric. The hostname's other characters may be outside the set of alphanumeric characters, dash, and period.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-117 Improper Output Neutralization for Logs

References#

https://iterm2.com/downloads.html
https://gitlab.com/gnachman/iterm2/-/commit/ef7bb84520013b2524df9787d4aa9f2c96746c01

Exploit#

No public exploit known

History#

Version 12023-10-22Record published in the CVE List.
Version 22024-09-11Most recent update recorded in the CVE List.