CVE-2026-41253: Displaying a File in iTerm2 Can Execute Attacker Code — No Stable Patch Yet

Running cat readme.txt in iTerm2 can execute attacker code on your machine with no further interaction. That’s the finding Calif Security Labs published April 18 as part of their “MAD Bugs” series — vulnerabilities that are absurd enough in their trigger conditions that “mad” is the operative word.

CVE-2026-41253 affects iTerm2 through version 3.6.9 — the current stable release. The CVSS score is 6.9 (Moderate), which substantially understates the real-world impact.

The Root Cause

iTerm2 includes an SSH integration feature called the “conductor” that allows the terminal to receive commands from remote SSH sessions via terminal escape sequences — specifically DCS 2000p and OSC 135. The conductor uses these sequences to transfer files, update window titles, and invoke local operations in response to server-side triggers.

The flaw: the conductor trusts these sequences from any terminal output, not just verified SSH connections. This means any file displayed in the terminal can embed escape sequences that iTerm2 will act on. The attacker needs no remote access, no elevated privileges, no network presence, and no running process. Just a file that iTerm2 displays.

The Attack in Practice

A malicious contributor adds a crafted readme.txt to a repository. You clone the repo, run cat readme.txt to inspect it, and iTerm2 silently executes the embedded payload. The attack works equally well on log files, CSV exports, .env examples, changelogs, or any text you pipe through the terminal.

The repository itself doesn’t need to be malicious. Any file you receive — a CI artifact download, a Slack file export, an API response piped to the terminal — can carry the payload. The attack surface is broad: it covers every repo you clone, every log you tail, every external file you preview.

No download prompt. No browser interaction. No privilege escalation dialog. Just cat.

The Fix Status

iTerm2 maintainer George Nachman committed a fix on March 31 (commit a9e7459), removing the implicit trust in escape sequences from non-SSH contexts. As of April 18, that patch is only in the nightly build. iTerm2 3.6.9 remains the current stable release and remains vulnerable.

Calif disclosed after confirming the fix was committed but before it reached a stable release — standard responsible disclosure practice. There is no stated ETA for when the patch will land in stable.

What To Do Now

• Disable SSH Integration immediately: iTerm2 → Preferences → Advanced → uncheck “Enable Shell Integration.” This removes the attack surface entirely and has no visible impact if you don’t use the SSH conductor feature.
• Switch to the nightly build if you need SSH integration — it contains the March 31 fix.
• Treat all unreviewed files as potentially hostile until a patched stable ships.

The vulnerability does not affect macOS Terminal, Alacritty, Warp, Kitty, or any other terminal that does not implement iTerm2’s conductor protocol.

If you’re a developer who regularly clones repos, audits third-party code, or tails log files in iTerm2, disable SSH Integration today. The attack is trivial to execute. The fix is sitting in a nightly build that most users will never install without prompting.