Medium
Security advisory
In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file whose name is valid output from the conductor encoding path, such as a pathname with an initial ace/c+ substring, aka "hypothetical in-band signaling abuse." This occurs because iTerm2 accepts the SSH conductor protocol from terminal output that does not originate from a legitimate conductor session.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-41253
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 17:01 UTC · Revision 1
Source evidence
In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file whose name is valid output from the conductor encoding path, such as a pathname with an initial ace/c+ substring, aka "hypothetical in-band signaling abuse." This occurs because iTerm2 accepts the SSH conductor protocol from terminal output that does not originate from a legitimate conductor session.
osv:CVE-2026-41253
Complete source record
{
"id": "7b7af86af6c765f2ee64e84fd2f4ede617a11de643e5270cd6c3e04855753c47",
"url": "https://osv.dev/vulnerability/CVE-2026-41253",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2026-41253",
"summary": "In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working directory contains a malicious file whose name is valid output from the conductor encoding path, such as a pathname with an initial ace/c+ substring, aka \"hypothetical in-band signaling abuse.\" This occurs because iTerm2 accepts the SSH conductor protocol from terminal output that does not originate from a legitimate conductor session.",
"evidence": "osv:CVE-2026-41253",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-41253",
"aliases": [
"CVE-2026-41253"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/gnachman/iterm2",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "a9e745993c2e2cbb30b884a16617cd5495899f86"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:iterm2:iterm2:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "3.6.9"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "a9e745993c2e2cbb30b884a16617cd5495899f86"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v20260330-nightly",
"v3.6.10beta1",
"v20260329-nightly",
"v20260328-nightly",
"v20260326-nightly",
"v20260320-nightly",
"v20260325-nightly",
"v20260323-nightly",
"v20260322-nightly",
"v20260321-nightly",
"v20260319-nightly",
"v20260318-nightly",
"v20260317-nightly",
"v20260316-nightly",
"v20260315-nightly",
"v20260314-nightly",
"v20260313-nightly",
"v20260312-nightly",
"v20260311-nightly",
"v20260310-nightly",
"v20260309-nightly",
"v20260307-nightly",
"v20260306-nightly",
"v20260305-nightly",
"v20260303-nightly",
"v20260302-nightly",
"v3.6.9beta1",
"v20260228-nightly",
"v20260227-nightly",
"v20260226-nightly",
"v20260225-nightly",
"v20260224-nightly",
"v20260220-nightly",
"v3.6.7",
"v20260219-nightly",
"v20260218-nightly",
"v20260216-nightly",
"v20260214-nightly",
"v20260213-nightly",
"v20260211-nightly",
"v20260210-nightly",
"v20260209-nightly",
"v20260208-nightly",
"v20260207-nightly",
"v20260206-nightly",
"v20260203-nightly",
"v20260202-nightly",
"v3.6.7beta2",
"v20260201-nightly",
"v20260130-nightly",
"v20260128-nightly",
"v20260127-nightly",
"v20260125-nightly",
"v20260124-nightly",
"v20260123-nightly",
"v20260122-nightly",
"v20260121-nightly",
"v20260120-nightly",
"v20260119-nightly",
"v20260113-nightly",
"v20260112-nightly",
"v20260111-nightly",
"v20260110-nightly",
"v20260109-nightly",
"v20260108-nightly",
"v20260107-nightly",
"v20260102-nightly",
"v20260101-nightly",
"v20251230-nightly",
"v20251229-nightly",
"v20251223-nightly",
"v20251222-nightly",
"v20251221-nightly",
"v20251220-nightly",
"v20251218-nightly",
"v20251216-nightly",
"v20251213-nightly",
"v20251211-nightly",
"v20251208-nightly",
"v20251207-nightly",
"v20251206-nightly",
"v20251203-nightly",
"v20251202-nightly",
"v20251201-nightly",
"v20251130-nightly",
"v20251128-nightly",
"v20251126-nightly",
"v20251125-nightly",
"v20251122-nightly",
"v20251120-nightly",
"v3.6.7beta1",
"v20251119-nightly",
"v3.6.6beta3",
"v20251112-nightly",
"v20251117-nightly",
"v20251115-nightly",
"v20251114-nightly",
"v20251113-nightly",
"v20251111-nightly",
"v20251110-nightly",
"v20251108-nightly",
"v3.6.6beta2",
"v20251107-nightly",
"v20251106-nightly",
"v20251105-nightly",
"v20251104-nightly",
"v20251103-nightly",
"v20251102-nightly",
"v20251101-nightly",
"v20251031-nightly",
"v20251030-nightly",
"v3.6.6beta1",
"v20251029-nightly",
"v20251028-nightly",
"v20251027-nightly",
"v20251026-nightly",
"v20251025-nightly",
"v20251024-nightly",
"v20251023-nightly",
"v20251022-nightly",
"v20251021-nightly",
"v20251020-nightly",
"v20251019-nightly",
"v20251018-nightly",
"v20251011-nightly",
"v20251010-nightly",
"v20251009-nightly",
"v20251008-nightly",
"v20251007-nightly",
"v3.6.3",
"v20251003-nightly",
"v20251006-nightly",
"v20251004-nightly",
"v20251001-nightly",
"v3.6.3beta1",
"v20250930-nightly",
"v20250928-nightly",
"v20250927-nightly",
"v20250926-nightly",
"v20250925-nightly",
"v3.6.2",
"v20250924-nightly",
"v20250923-nightly",
"v20250920-nightly",
"v3.6.1",
"v20250919-nightly",
"v20250917-nightly",
"v3.6.0",
"v3.6.0beta4",
"v20250908-nightly",
"v20250906-nightly",
"v20250905-nightly",
"v20250903-nightly",
"v20250902-nightly",
"v20250829-nightly",
"v20250828-nightly",
"v20250827-nightly",
"v3.6.0beta2",
"v20250821-nightly",
"v20250820-nightly",
"v20250819-nightly",
"v20250818-nightly",
"v20250817-nightly",
"v20250816-nightly",
"v20250814-nightly",
"v20250813-nightly",
"v20250812-nightly",
"v20250810-nightly",
"v20250809-nightly",
"v20250808-nightly",
"v20250806-nightly",
"v20250805-nightly",
"v20250804-nightly",
"v20250803-nightly",
"v20250802-nightly",
"v20250729-nightly",
"v20250728-nightly",
"v20250726-nightly",
"v20250725-nightly",
"v20250724-nightly",
"v3.6.0beta1",
"v20250721-nightly",
"v20250720-nightly",
"v20250711-nightly",
"v20250710-nightly",
"v20250709-nightly",
"v20250705-nightly",
"v20250704-nightly",
"v20250703-nightly",
"v20250618-nightly",
"v3.5.15beta1",
"v20250617-nightly",
"v20250616-nightly",
"v20250615-nightly",
"v20250614-nightly",
"v20250611-nightly",
"v20250530-nightly",
"v20250529-nightly",
"v20250528-nightly",
"v20250527-nightly",
"v20250526-nightly",
"v20250524-nightly",
"v20250523-nightly",
"v20250520-nightly",
"v20250516-nightly",
"v20250515-nightly",
"v20250511-nightly",
"v20250509-nightly",
"v20250507-nightly",
"v20250425-nightly",
"v20250414-nightly",
"v20250413-nightly",
"v20250411-nightly",
"v20250409-nightly",
"v20250408-nightly",
"v20250406-nightly",
"v20250404-nightly",
"v20250403-nightly",
"v20250402-nightly",
"v3.5.12beta2",
"v20250128-nightly",
"v20250331-nightly",
"v20250330-nightly",
"v20250329-nightly",
"v20250327-nightly",
"v20250326-nightly",
"v20250325-nightly",
"v20250323-nightly",
"v20250322-nightly",
"v20250321-nightly",
"v20250320-nightly",
"v20250319-nightly",
"v20250318-nightly",
"v20250316-nightly",
"v20250310-nightly",
"v20250309-nightly",
"v20250308-nightly",
"v20250307-nightly",
"v20250306-nightly",
"v20250228-nightly",
"v20250227-nightly",
"v20250226-nightly",
"v20250209-nightly",
"v20250208-nightly",
"v20250206-nightly",
"v20250202-nightly",
"v20250201-nightly",
"v20250131-nightly",
"v20250130-nightly",
"v20250129-nightly",
"v20250127-nightly",
"v20250122-nightly",
"v20250118-nightly",
"v20250117-nightly",
"v20250116-nightly",
"v20250115-nightly",
"v20250114-nightly",
"v20250112-nightly",
"v20250111-nightly",
"v20250107-nightly",
"v20250105-nightly",
"v20250104-nightly",
"v3.5.12beta1",
"v20250103-nightly",
"v20250101-nightly",
"v20241231-nightly",
"v20241229-nightly",
"v20241219-nightly",
"v20241218-nightly",
"v3.5.11beta2",
"v20241217-nightly",
"v20241216-nightly",
"v20241215-nightly",
"v20241213-nightly",
"v20241210-nightly",
"v20241208-nightly",
"v20241207-nightly",
"v20241206-nightly",
"v20241205-nightly",
"v20241204-nightly",
"v20241130-nightly",
"v20241129-nightly",
"v20241128-nightly",
"v3.5.11beta1",
"v20241127-nightly",
"v3.5.11",
"v20241125-nightly",
"v20241120-nightly",
"v20241115-nightly",
"v20241114-nightly",
"v20241113-nightly",
"v20241105-nightly",
"v20241101-nightly",
"v20241027-nightly",
"v3.5.6beta3",
"v20241023-nightly",
"v20241026-nightly",
"v20241025-nightly",
"v20241024-nightly",
"v20241018-nightly",
"v20241017-nightly",
"v3.5.6beta1",
"v3.5.6beta2",
"v20241016-nightly",
"v20241012-nightly",
"v20241008-nightly",
"v20241007-nightly",
"v20241004-nightly",
"v20241002-nightly",
"v20241001-nightly",
"v20240930-nightly",
"v20240929-nightly",
"v20240928-nightly",
"v20240920-nightly",
"v3.5.5beta2",
"v20240919-nightly",
"v20240913-nightly",
"v20240912-nightly",
"v20240911-nightly",
"v3.5.5beta1",
"v20240910-nightly",
"v20240909-nightly",
"v20240908-nightly",
"v20240907-nightly",
"v20240906-nightly",
"v20240905-nightly",
"v20240904-nightly",
"v20240903-nightly",
"v20240830-nightly",
"v20240828-nightly",
"v20240816-nightly",
"v20240815-nightly",
"v20240814-nightly",
"v20240811-nightly",
"v20240810-nightly",
"v20240809-nightly",
"v20240727-nightly",
"v20240726-nightly",
"v20240723-nightly",
"v20240722-nightly",
"v20240720-nightly",
"v3.5.4beta1",
"v20240719-nightly",
"v20240716-nightly",
"v20240709-nightly",
"v20240708-nightly",
"v20240707-nightly",
"v20240706-nightly",
"v20240705-nightly",
"v20240704-nightly",
"v20240703-nightly",
"v20240701-nightly",
"v20240628-nightly",
"v20240627-nightly",
"v20240626-nightly",
"v3.5.3beta1",
"v20240614-nightly",
"v20240625-nightly",
"v20240622-nightly",
"v20240621-nightly",
"v20240619-nightly",
"v20240618-nightly",
"v20240617-nightly",
"v20240613-nightly",
"v20240612-nightly",
"v20240611-nightly",
"v20240610-nightly",
"v20240606-nightly",
"v20240605-nightly",
"v20240604-nightly",
"v20240603-nightly",
"v20230621-nightly",
"v20230620-nightly",
"v20230619-nightly",
"v20240602-nightly",
"v20240531-nightly",
"v20240530-nightly",
"v3.5.1beta3",
"v20240529-nightly",
"v20240528-nightly",
"v3.5.1beta2",
"v20240524-nightly",
"v20240523-nightly",
"v20240522-nightly",
"v20240521-nightly",
"v3.5.1beta1",
"v3.5.1.beta1",
"v20240518-nightly",
"v3.5.0beta26",
"v20240517-nightly",
"v20240516-nightly",
"v20240515-nightly",
"v20240513-nightly",
"v20240511-nightly",
"v20240510-nightly",
"v20240508-nightly",
"v3.5.0beta25",
"v20240507-nightly",
"v20240426-nightly",
"v20240425-nightly",
"v3.5.0beta24",
"v20240424-nightly",
"v20240423-nightly",
"v20240422-nightly",
"v20240421-nightly",
"v20240417-nightly",
"v20240416-nightly",
"v20240415-nightly",
"v20240414-nightly",
"v20240413-nightly",
"v20240409-nightly",
"v20240329-nightly",
"v20240328-nightly",
"v20240320-nightly",
"v20240319-nightly",
"v3.5.0beta22",
"v20240318-nightly",
"v20240317-nightly",
"v3.5.0beta21",
"v20240306-nightly",
"v20240305-nightly",
"v20240303-nightly",
"v20240301-nightly",
"v20240222-nightly",
"v20240218-nightly",
"v20240214-nightly",
"v20240213-nightly",
"v20240212-nightly",
"v3.5.0beta20",
"v20240207-nightly",
"v20240206-nightly",
"v20240204-nightly",
"v20240201-nightly",
"v20240131-nightly",
"v20240130-nightly",
"v20240129-nightly",
"v20240127-nightly",
"v20240126-nightly",
"v20240125-nightly",
"v20240124-nightly",
"v20240123-nightly",
"v3.5.0beta19",
"v20240119-nightly",
"v20240117-nightly",
"v20240116-nightly",
"v20240108-nightly",
"v20240107-nightly",
"v20240106-nightly",
"v20231229-nightly",
"v20231228-nightly",
"v20231227-nightly",
"v3.5.0beta18",
"v20231214-nightly",
"v20231129-nightly",
"v20231128-nightly",
"v20231127-nightly",
"v20231124-nightly",
"v20231122-nightly",
"v20231121-nightly",
"v20231116-nightly",
"v20231109-nightly",
"v20231108-nightly",
"v20231106-nightly",
"v20231103-nightly",
"v20231102-nightly",
"v20231031-nightly",
"v20231030-nightly",
"v20231027-nightly",
"v20231026-nightly",
"v3.5.0beta17",
"v20231025-nightly",
"v3.5.0beta16",
"v20231023-nightly",
"v20231021-nightly",
"v20231018-nightly",
"v20231016-nightly",
"v20231015-nightly",
"v20231011-nightly",
"v20231010-nightly",
"v20231009-nightly",
"v20231006-nightly",
"v3.5.0beta15",
"v3.5.0beta14",
"v20230927-nightly",
"v20230926-nightly",
"v3.5.0beta13",
"v20230923-nightly",
"v3.5.0beta12",
"v20230914-nightly",
"v20230908-nightly",
"v20230907-nightly",
"v20230903-nightly",
"v20230829-nightly",
"v20230827-nightly",
"v20230814-nightly",
"v20230813-nightly",
"v20230812-nightly",
"v3.5.0beta11",
"v20230805-nightly",
"v20230729-nightly",
"v20230725-nightly",
"v20230724-nightly",
"v20230719-nightly",
"v20230715-nightly",
"v20230616-nightly",
"v20230613-nightly",
"v20230609-nightly",
"v20230608-nightly",
"v20230605-nightly",
"v20230530-nightly",
"v20230529-nightly",
"v20230525-nightly",
"v20230524-nightly",
"v20230523-nightly",
"v20230522-nightly",
"v20230519-nightly",
"v20230516-nightly",
"v20230515-nightly",
"v20230514-nightly",
"v20230513-nightly",
"v20230512-nightly",
"v20230511-nightly",
"v20230510-nightly",
"v20230509-nightly",
"v20230508-nightly",
"v20230505-nightly",
"v20230503-nightly",
"v20230502-nightly",
"v20230501-nightly",
"v20230429-nightly",
"v20230405-nightly",
"v20230404-nightly",
"v20230401-nightly",
"v20230323-nightly",
"v20230322-nightly",
"v20230321-nightly",
"v20230308-nightly",
"v20230307-nightly",
"v20230306-nightly",
"v20230225-nightly",
"v20230224-nightly",
"v20230223-nightly",
"v20230217-nightly",
"v20230216-nightly",
"v20230214-nightly",
"v20230213-nightly",
"v3.5.0beta10",
"v20230211-nightly",
"v20230204-nightly",
"v20230110-nightly",
"v20230109-nightly",
"v20230108-nightly",
"v20230107-nightly",
"v20230104-nightly",
"v3.5.0beta9",
"v20230103-nightly",
"v20230101-nightly",
"v20221231-nightly",
"v20221228-nightly",
"v20221218-nightly",
"v20221217-nightly",
"v20221216-nightly",
"v20221213-nightly",
"v20221210-nightly",
"v20221209-nightly",
"v20221203-nightly",
"v20221130-nightly",
"v20221129-nightly",
"v20221128-nightly",
"v20221127-nightly",
"v20221122-nightly",
"v20221121-nightly",
"v20221120-nightly",
"v3.5.0beta8",
"v20221116-nightly",
"v20221115-nightly",
"v20221026-nightly",
"v20221025-nightly",
"v20220924-nightly",
"v20220922-nightly",
"v3.5.0beta7",
"v20220915-nightly",
"v20220914-nightly",
"v20220912-nightly",
"v20220905-nightly",
"v20220904-nightly",
"v20220901-nightly",
"v20220831-nightly",
"v20220830-nightly",
"v20220828-nightly",
"v20220825-nightly",
"v20220824-nightly",
"v20220823-nightly",
"v20220818-nightly",
"v20220815-nightly",
"v20220810-nightly",
"v20220806-nightly",
"v20220804-nightly",
"v20220803-nightly",
"v20220721-nightly",
"v20220718-nightly",
"v20220716-nightly",
"v20220715-nightly",
"v20220714-nightly",
"v20220713-nightly",
"v20220712-nightly",
"v20220711-nightly",
"v20220710-nightly",
"v20220708-nightly",
"v20220707-nightly",
"v20220706-nightly",
"v20220702-nightly",
"v20220701-nightly",
"v3.5.0beta6",
"img-bad",
"img-good",
"v20220627-nightly",
"v20220626-nightly",
"v20220625-nightly",
"v20220624-nightly",
"v20220623-nightly",
"v20220622-nightly",
"v20220621-nightly",
"v20220620-nightly",
"v20220619-nightly",
"v20220618-nightly",
"v20220617-nightly",
"v20220616-nightly",
"v20220605-nightly",
"v20220602-nightly",
"v20220601-nightly",
"v20220528-nightly",
"v20220526-nightly",
"v20220525-nightly",
"v20220524-nightly",
"v20220523-nightly",
"v20220522-nightly",
"v20220510-nightly",
"v20220506-nightly",
"v20220503-nightly",
"v20220501-nightly",
"v20220430-nightly",
"v20220429-nightly",
"v20220412-nightly",
"v20220411-nightly",
"v20220410-nightly",
"v20220409-nightly",
"v20220408-nightly",
"v20220407-nightly",
"v20220406-nightly",
"v20220405-nightly",
"v20220404-nightly",
"v20220403-nightly",
"v20220402-nightly",
"v20220330-nightly",
"v20220329-nightly",
"v20220328-nightly",
"v20220327-nightly",
"v20220326-nightly",
"v20220319-nightly",
"v20220318-nightly",
"v20220317-nightly",
"v20220316-nightly",
"v20220315-nightly",
"v20220314-nightly",
"v20220313-nightly",
"v20220312-nightly",
"v3.5.0beta5",
"v20220311-nightly",
"v20220310-nightly",
"v20220309-nightly",
"v20220307-nightly",
"v20220304-nightly",
"v20220303-nightly",
"v20220301-nightly",
"v20220226-nightly",
"v20220225-nightly",
"v20220224-nightly",
"v20220223-nightly",
"v20220220-nightly",
"v20220218-nightly",
"v20220215-nightly",
"v20220214-nightly",
"v20220212-nightly",
"v20220211-nightly",
"v20220210-nightly",
"v20220209-nightly",
"v20220208-nightly",
"v20220207-nightly",
"v20220206-nightly",
"v20220205-nightly",
"v20220204-nightly",
"v20220203-nightly",
"v20220202-nightly",
"v20220201-nightly",
"v20220131-nightly",
"v20220130-nightly",
"v20220128-nightly",
"v20220107-nightly",
"v3.5.0beta4",
"v3.5.0beta3",
"v20211201-nightly",
"v20211129-nightly",
"v20211125-nightly",
"v20211120-nightly",
"v20211119-nightly",
"v20211118-nightly",
"v20211117-nightly",
"v20211116-nightly",
"v20211112-nightly",
"v20211107-nightly",
"v20211106-nightly",
"v20211105-nightly",
"v20211101-nightly",
"v20211030-nightly",
"v20211029-nightly",
"v20211028-nightly",
"v20211027-nightly",
"v20211023-nightly",
"v20211021-nightly",
"v20211020-nightly",
"v20211019-nightly",
"v20211016-nightly",
"v20211015-nightly",
"v20211014-nightly",
"v20211013-nightly",
"v20211012-nightly",
"v20211010-nightly",
"v20211008-nightly",
"v20211007-nightly",
"v20211006-nightly",
"v20211005-nightly",
"v20211004-nightly",
"v20211003-nightly",
"v20211002-nightly",
"v20210930-nightly",
"v20210929-nightly",
"v20210928-nightly",
"v20210927-nightly",
"v3.5.0beta1",
"v20210924-nightly",
"v20210923-nightly",
"v20210916-nightly",
"v20210914-nightly",
"v20210911-nightly",
"v20210910-nightly",
"v20210909-nightly",
"v20210908-nightly",
"v20210903-nightly",
"v20210830-nightly",
"v20210829-nightly",
"v20210828-nightly",
"v20210827-nightly",
"v20210826-nightly",
"v20210825-nightly",
"v20210824-nightly",
"v3.4.9beta1",
"v20210823-nightly",
"v20210822-nightly",
"v20210821-nightly",
"v20210820-nightly",
"v20210819-nightly",
"v20210818-nightly",
"v20210817-nightly",
"v20210816-nightly",
"v20210815-nightly",
"v20210812-nightly",
"v20210811-nightly",
"v20210809-nightly",
"v20210806-nightly",
"v20210804-nightly",
"v20210803-nightly",
"v20210802-nightly",
"v20210727-nightly",
"v20210726-nightly",
"v20210725-nightly",
"v20210722-nightly",
"v20210720-nightly",
"v20210719-nightly",
"v20210718-nightly",
"v20210714-nightly",
"v20210713-nightly",
"v20210708-nightly",
"v20210707-nightly",
"v20210706-nightly",
"v20210704-nightly",
"v20210703-nightly",
"v20210702-nightly",
"v20210701-nightly",
"v20210629-nightly",
"v20210628-nightly",
"v20210627-nightly",
"v20210624-nightly",
"v20210621-nightly",
"v20210619-nightly",
"v20210613-nightly",
"v20210612-nightly",
"v20210610-nightly",
"v20210609-nightly",
"v20210608-nightly",
"v20210607-nightly",
"v20210606-nightly",
"v20210604-nightly",
"v20210530-nightly",
"v20210529-nightly",
"v20210527-nightly",
"v20210523-nightly",
"v20210521-nightly",
"v20210518-nightly",
"v20210516-nightly",
"v20210515-nightly",
"v20210513-nightly",
"v20210512-nightly",
"v20210511-nightly",
"v20210510-nightly",
"v20210509-nightly",
"v20210508-nightly",
"v20210507-nightly",
"v20210504-nightly",
"v20210503-nightly",
"v20210502-nightly",
"v20210501-nightly",
"v20210430-nightly",
"v20210426-nightly",
"v20210425-nightly",
"v20210423-nightly",
"v20210421-nightly",
"v20210420-nightly",
"v20210419-nightly",
"v20210418-nightly",
"v20210417-nightly",
"v20210407-nightly",
"v20210406-nightly",
"v20210405-nightly",
"v20210404-nightly",
"v20210403-nightly",
"v20210402-nightly",
"v20210401-nightly",
"v20210330-nightly",
"v20210329-nightly",
"v20210325-nightly",
"v20210324-nightly",
"v20210323-nightly",
"v20210322-nightly",
"v20210319-nightly",
"v20210315-nightly",
"v20210314-nightly",
"v20210313-nightly",
"v3.4.5beta1",
"v20210215-nightly",
"v20210311-nightly",
"v20210310-nightly",
"v20210309-nightly",
"v20210308-nightly",
"v20210305-nightly",
"v20210304-nightly",
"v20210303-nightly",
"v20210302-nightly",
"v20210301-nightly",
"v20210226-nightly",
"v20210225-nightly",
"v20210222-nightly",
"v20210218-nightly",
"v20210217-nightly",
"v20210214-nightly",
"v20210213-nightly",
"v20210211-nightly",
"v20210210-nightly",
"v20210209-nightly",
"v20210208-nightly",
"v20210207-nightly",
"v20210206-nightly",
"v20210205-nightly",
"v20210204-nightly",
"v20210203-nightly",
"v20210131-nightly",
"v20210128-nightly",
"v20210125-nightly",
"v3.4.4beta3",
"v20210111-nightly",
"v20210124-nightly",
"v20210122-nightly",
"v20210120-nightly",
"v20210119-nightly",
"v20210116-nightly",
"v20210110-nightly",
"v20210109-nightly",
"v20210106-nightly",
"v20210105-nightly",
"v20210104-nightly",
"v3.4.4beta2",
"v20210103-nightly",
"v20210102-nightly",
"v20210101-nightly",
"v20201231-nightly",
"v20201230-nightly",
"v20201229-nightly",
"v20201228-nightly",
"v3.4.4beta1",
"v20201225-nightly",
"v20201223-nightly",
"v20201222-nightly",
"v20201220-nightly",
"v20201219-nightly",
"v20201217-nightly",
"v20201215-nightly",
"v20201213-nightly",
"v20201212-nightly",
"v20201211-nightly",
"v20201209-nightly",
"v20201208-nightly",
"v20201130-nightly",
"v20201128-nightly",
"v20201127-nightly",
"v20201123-nightly",
"v20201120-nightly",
"v20201117-nightly",
"v3.4.0",
"v20201105-nightly",
"vv3.4.0beta13",
"v3.4.0beta13",
"v20201103-nightly",
"v20201101-nightly",
"v20201031-nightly",
"v20201030-nightly",
"v20201029-nightly",
"v3.4.0beta12",
"v20201026-nightly",
"v20201025-nightly",
"v3.4.0beta11",
"v20201016-nightly",
"v20201015-nightly",
"v20201012-nightly",
"v20201011-nightly",
"v20201009-nightly",
"v20201008-nightly",
"v20201007-nightly",
"v20201005-nightly",
"v3.4.0beta10",
"v20201004-nightly",
"v20201003-nightly",
"v20201001-nightly",
"v3.4.0beta9",
"v20200921-nightly",
"v3.4.0beta8",
"v20200920-nightly",
"v20200919-nightly",
"v20200918-nightly",
"v3.4.0beta7",
"v20200916-nightly",
"v20200914-nightly",
"v20200913-nightly",
"v20200912-nightly",
"v20200911-nightly",
"v20200910-nightly",
"v3.4.0beta6",
"v20200908-nightly",
"v20200907-nightly",
"v20200905-nightly",
"v20200904-nightly",
"v20200903-nightly",
"v20200902-nightly",
"v20200901-nightly",
"v3.4.0beta5",
"v20200831-nightly",
"v20200830-nightly",
"v20200829-nightly",
"v20200828-nightly",
"v20200801-nightly",
"v20200825-nightly",
"v20200823-nightly",
"v20200822-nightly",
"v20200819-nightly",
"v20200818-nightly",
"v20200817-nightly",
"v3.4.0beta4",
"v20200816-nightly",
"v20200815-nightly",
"v20200814-nightly",
"v20200813-nightly",
"v20200812-nightly",
"v20200809-nightly",
"v3.4.0beta3",
"v20200808-nightly",
"v20200807-nightly",
"v20200806-nightly",
"v20200727-nightly",
"v20200726-nightly",
"v20200725-nightly",
"v20200724-nightly",
"v20200723-nightly",
"v20200722-nightly",
"v20200721-nightly",
"v3.4.0beta2",
"v20200720-nightly",
"v20200719-nightly",
"v20200718-nightly",
"v20200713-nightly",
"v20200712-nightly",
"v20200711-nightly",
"v20200710-nightly",
"v20200709-nightly",
"v20200707-nightly",
"v20200706-nightly",
"v20200705-nightly",
"v20200704-nightly",
"v20200703-nightly",
"v20200630-nightly",
"v20200629-nightly",
"v20200627-nightly",
"v20200626-nightly",
"v20200625-nightly",
"v20200624-nightly",
"v20200622-nightly",
"v20200621-nightly",
"v20200620-nightly",
"v20200619-nightly",
"v20200617-nightly",
"v20200616-nightly",
"v20200615-nightly",
"v20200614-nightly",
"v20200613-nightly",
"v20200612-nightly",
"v20200611-nightly",
"v20200610-nightly",
"v20200609-nightly",
"v20200607-nightly",
"v20200604-nightly",
"v20200602-nightly",
"v20200530-nightly",
"v20200529-nightly",
"v20200528-nightly",
"v20200527-nightly",
"v20200526-nightly",
"v20200523-nightly",
"v20200522-nightly",
"v20200521-nightly",
"v20200520-nightly",
"v20200518-nightly",
"v20200517-nightly",
"v20200516-nightly",
"v20200515-nightly",
"v20200514-nightly",
"v20200513-nightly",
"v20200512-nightly",
"v20200511-nightly",
"v20200508-nightly",
"v20200507-nightly",
"v20200506-nightly",
"v20200505-nightly",
"v20200504-nightly",
"v20200503-nightly",
"v20200502-nightly",
"v20200501-nightly",
"v20200430-nightly",
"v20200427-nightly",
"v20200426-nightly",
"v20200425-nightly",
"v20200424-nightly",
"v20200423-nightly",
"v20200422-nightly",
"v20200421-nightly",
"v20200420-nightly",
"v20200419-nightly",
"v20200418-nightly",
"v20200417-nightly",
"v20200416-nightly",
"v20200413-nightly",
"v20200412-nightly",
"v20200410-nightly",
"v20200409-nightly",
"v20200408-nightly",
"v20200407-nightly",
"v20200406-nightly",
"v20200405-nightly",
"v20200403-nightly",
"v20200402-nightly",
"v20200331-nightly",
"v20200330-nightly",
"v20200329-nightly",
"v20200328-nightly",
"v20200327-nightly",
"v20200326-nightly",
"v20200325-nightly",
"v20200324-nightly",
"v20200323-nightly",
"v20200322-nightly",
"v20200321-nightly",
"v20200315-nightly",
"v20200313-nightly",
"v20200312-nightly",
"v20200310-nightly",
"v20200309-nightly",
"v20200308-nightly",
"v20200307-nightly",
"v20200306-nightly",
"v20200305-nightly",
"v20200304-nightly",
"v3.3.10beta1",
"v20200302-nightly",
"v20200301-nightly",
"v20200229-nightly",
"v20200228-nightly",
"v20200227-nightly",
"v20200226-nightly",
"v20200225-nightly",
"v20200223-nightly",
"v20200222-nightly",
"v20200221-nightly",
"v20200218-nightly",
"v20200217-nightly",
"v20200216-nightly",
"v20200212-nightly",
"v20200211-nightly",
"v20200210-nightly",
"v20200209-nightly",
"v20200207-nightly",
"v20200205-nightly",
"v20200204-nightly",
"v20200203-nightly",
"v20200202-nightly",
"v20200201-nightly",
"v20200129-nightly",
"v20200121-nightly",
"v20200128-nightly",
"v20200127-nightly",
"v20200126-nightly",
"v20200125-nightly",
"v20200122-nightly",
"v20200120-nightly",
"v20200112-nightly",
"v20200111-nightly",
"v20200110-nightly",
"v20200109-nightly",
"v20200108-nightly",
"v20200107-nightly",
"v20200106-nightly",
"v20200105-nightly",
"v20200104-nightly",
"v20200102-nightly",
"v20200101-nightly",
"v20191231-nightly",
"v20191230-nightly",
"v20191226-nightly",
"v20191225-nightly",
"v20191224-nightly",
"v20191223-nightly",
"v20191220-nightly",
"v20191218-nightly",
"v3.3.8beta3",
"v20191217-nightly",
"v3.3.8beta2",
"v20191215-nightly",
"v20191214-nightly",
"v20191213-nightly",
"v20191212-nightly",
"v20191210-nightly",
"v20191209-nightly",
"v20191208-nightly",
"v20191207-nightly",
"v20191206-nightly",
"v20191205-nightly",
"v20191204-nightly",
"v20191203-nightly",
"v20191202-nightly",
"v20191127-nightly",
"v20191126-nightly",
"v3.3.8beta1",
"v20191125-nightly",
"v20191124-nightly",
"v20191123-nightly",
"v20191122-nightly",
"v20191121-nightly",
"v20191120-nightly",
"v20191118-nightly",
"v3.3.7beta4",
"v20191117-nightly",
"v20191115-nightly",
"v20191114-nightly",
"v20191113-nightly",
"v20191112-nightly",
"v20191111-nightly",
"v20191110-nightly",
"v20191108-nightly",
"v20191107-nightly",
"v20191106-nightly",
"v20191105-nightly",
"v3.3.7beta3",
"v20191104-nightly",
"v20191101-nightly",
"v20190623-nightly",
"v20190829-nightly",
"v20191030-nightly",
"v20191029-nightly",
"v3.3.7beta2",
"v20191023-nightly",
"v20191020-nightly",
"v20191018-nightly",
"v20191016-nightly",
"v20191015-nightly",
"v20191013-nightly",
"v20191011-nightly",
"v3.3.7beta1",
"v20191004-nightly",
"v20190930-nightly",
"v20190929-nightly",
"v3.3.5beta2",
"v20190920-nightly",
"v20190919-nightly",
"v20190917-nightly",
"v20190916-nightly",
"v3.3.5beta1",
"v20190914-nightly",
"v20190913-nightly",
"v20190912-nightly",
"v20190911-nightly",
"v20190909-nightly",
"v3.3.4",
"v3.3.4beta1",
"v20190908-nightly",
"v20190907-nightly",
"v20190906-nightly",
"v20190905-nightly",
"v3.3.3beta2",
"v20190904-nightly",
"v20190828-nightly",
"v20190827-nightly",
"v20190826-nightly",
"v20190825-nightly",
"v20190824-nightly",
"v20190823-nightly",
"v20190822-nightly",
"v20190820-nightly",
"v3.3.3beta1",
"v20190819-nightly",
"v3.3.2beta2",
"v20190818-nightly",
"v20190816-nightly",
"v20190815-nightly",
"v20190814-nightly",
"v20190813-nightly",
"v20190812-nightly",
"v20190810-nightly",
"v20190809-nightly",
"v20190808-nightly",
"v20190807-nightly",
"v3.3.2beta1",
"v20190806-nightly",
"v20190802-nightly",
"v20190801-nightly",
"v3.3.0beta16",
"v20190729-nightly",
"v20190731-nightly",
"v20190728-nightly",
"v20190725-nightly",
"v20190724-nightly",
"v20190722-nightly",
"v3.3.0beta15",
"v20190717-nightly",
"v20190721-nightly",
"v3.3.0beta14",
"v20190719-nightly",
"v20190715-nightly",
"v20190626-nightly",
"v20190625-nightly",
"v3.3.0beta13",
"v20190617-nightly",
"v3.3.0beta12",
"v20190616-nightly",
"v20190615-nightly",
"v20190614-nightly",
"v20190613-nightly",
"v20190610-nightly",
"v3.3.0beta11",
"v20190606-nightly",
"v20190603-nightly",
"v20190604-nightly",
"v3.3.0beta10",
"v20190602-nightly",
"v20190601-nightly",
"v20190531-nightly",
"v20190530-nightly",
"v20190529-nightly",
"v20190528-nightly",
"v3.3.0beta9",
"v20190527-nightly",
"v20190526-nightly",
"v20190523-nightly",
"v20190522-nightly",
"v20190521-nightly",
"v20190520-nightly",
"v3.3.0beta8",
"v20190519-nightly",
"v20190517-nightly",
"v20190516-nightly",
"v20190515-nightly",
"v20190514-nightly",
"v3.3.0beta7",
"v20190512-nightly",
"v20190511-nightly",
"v20190510-nightly",
"v20190508-nightly",
"v20190507-nightly",
"v3.3.0beta6",
"v20190506-nightly",
"v20190502-nightly",
"v20190430-nightly",
"v20190429-nightly",
"v3.3.0beta5",
"v20190428-nightly",
"v20190427-nightly",
"v20190425-nightly",
"v20190424-nightly",
"v20190423-nightly",
"v20190422-nightly",
"v3.3.0beta4",
"v20190421-nightly",
"v20190420-nightly",
"v20190418-nightly",
"v20190415-nightly",
"v3.3.0beta3",
"v20190414-nightly",
"v20190413-nightly",
"v20190412-nightly",
"v20190411-nightly",
"v20190407-nightly",
"v20190405-nightly",
"v20190404-nightly",
"v20190403-nightly",
"v20190402-nightly",
"v20190401-nightly",
"v3.3.0beta2",
"v20190331-nightly",
"v20190329-nightly",
"v20190328-nightly",
"v20190327-nightly",
"v20190326-nightly",
"v20190325-nightly",
"v3.3.0beta1",
"v20190324-nightly",
"v20190323-nightly",
"v20190322-nightly",
"v20190321-nightly",
"v20190320-nightly",
"v20190319-nightly",
"v20190318-nightly",
"v20190317-nightly",
"v20190315-nightly",
"v20190313-nightly",
"v20190312-nightly",
"v20190310-nightly",
"v20190309-nightly",
"v20190308-nightly",
"v20190307-nightly",
"v20190306-nightly",
"v20190304-nightly",
"v20190303-nightly",
"v20190302-nightly",
"v20190228-nightly",
"v20190226-nightly",
"v20190225-nightly",
"v20190224-nightly",
"v20190222-nightly",
"v20190220-nightly",
"v20190219-nightly",
"v20190218-nightly",
"v20190217-nightly",
"v20190215-nightly",
"v20190214-nightly",
"v20190212-nightly",
"v20190211-nightly",
"v20190210-nightly",
"v20190207-nightly",
"v20190206-nightly",
"v20190205-nightly",
"v20190204-nightly",
"v20190203-nightly",
"v20190117-nightly",
"v20190116-nightly",
"v20190115-nightly",
"v20190114-nightly",
"v20190113-nightly",
"v20190112-nightly",
"v20190111-nightly",
"v20190110-nightly",
"v20190109-nightly",
"v20190106-nightly",
"v20190105-nightly",
"v20190104-nightly",
"v20190103-nightly",
"v20190102-nightly",
"v20190101-nightly",
"v20181231-nightly",
"v20181230-nightly",
"v20181229-nightly",
"v20181228-nightly",
"v20181227-nightly",
"v20181226-nightly",
"v20181225-nightly",
"v20181224-nightly",
"v20181223-nightly",
"v20181222-nightly",
"v20181221-nightly",
"v20181220-nightly",
"v20181219-nightly",
"v20181218-nightly",
"v20181217-nightly",
"v20181215-nightly",
"v20181214-nightly",
"v20181213-nightly",
"v20181212-nightly",
"v20181211-nightly",
"v20181210-nightly",
"v20181209-nightly",
"v20181208-nightly",
"v20181207-nightly",
"v20181206-nightly",
"v20181205-nightly",
"v20181204-nightly",
"v20181203-nightly",
"v20181202-nightly",
"v20181201-nightly",
"v20181130-nightly",
"v20181129-nightly",
"v20181128-nightly",
"v20181127-nightly",
"v20181126-nightly",
"v20181125-nightly",
"v20181124-nightly",
"v20181123-nightly",
"v20181122-nightly",
"v20181121-nightly",
"v20181120-nightly",
"v20181119-nightly",
"v20181118-nightly",
"v20181117-nightly",
"v20181116-nightly",
"v20181112-nightly",
"v20181111-nightly",
"v20181110-nightly",
"v20181109-nightly",
"v20181108-nightly",
"v20181107-nightly",
"v20181106-nightly",
"v20181105-nightly",
"v20181104-nightly",
"v20181029-nightly",
"v20181028-nightly",
"v20181027-nightly",
"v20181026-nightly",
"v20181025-nightly",
"v20181024-nightly",
"v20181023-nightly",
"v20181022-nightly",
"v20181021-nightly",
"v20181020-nightly",
"v20181018-nightly",
"v20181016-nightly",
"v20181015-nightly",
"v20181014-nightly",
"v20181013-nightly",
"v20181012-nightly",
"v20181011-nightly",
"v20181010-nightly",
"v20181009-nightly",
"v20181008-nightly",
"v20181007-nightly",
"v20181006-nightly",
"v20181005-nightly",
"v20181004-nightly",
"v20181003-nightly",
"v20181002-nightly",
"v20181001-nightly",
"v20180930-nightly",
"v20180929-nightly",
"v20180928-nightly",
"v20180927-nightly",
"v20180926-nightly",
"v20180925-nightly",
"v20180924-nightly",
"v20180919-nightly",
"v20180918-nightly",
"v3.1.6beta3",
"v3.1.6beta2",
"v3.1.5",
"v3.1.5.beta.2",
"v3.1.5.beta.1",
"v3.1.4.beta.1",
"v3.1.3.beta.1",
"v3.1.3",
"v3.1.2.beta.2",
"v3.1.2.beta.1",
"v3.1.0",
"v3.1.beta.10",
"v3.1.beta.9",
"v3.1.beta.8",
"v3.1.beta.7",
"v3.1.beta.6",
"v3.1.beta.5",
"v3.1.beta.3",
"v3.1.beta.2",
"v3.1.beta.1",
"v3.1.0.beta",
"v3.0.4",
"v+3.0.4",
"v3.0.3",
"v3.0.2",
"v3.0.2-preview",
"v3.0.1-preview",
"v3.0.20160531",
"v3.0.0",
"v2.9.20160523",
"v2.9.20160426",
"v2.9.20160313",
"v2.9.20160102",
"v2.9.20151229",
"v2.9.20151111",
"v1.0.0.20130613",
"v20130302",
"v1.0.0.20130210",
"v1.0.0.20120726",
"v1.0.0.20120203",
"v1.0.0.20120107",
"v1.0.0.20111219",
"v1.0.0.20111020",
"v1.0.0.20111009",
"v1.0.0.20110909",
"v1.0.0.20110907b",
"v1.0.0.20110907",
"v1.0.0.20110828",
"v1.0.0.20110821",
"v1.0.0.20110810",
"v1.0.0.20110804",
"v1.0.0.20110727",
"v1.0.0.20110724"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41253.json"
}
}
],
"modified": "2026-10-28T02:30:37.956720302Z",
"provider": "osv",
"references": [
"https://iterm2.com/downloads.html",
"https://news.ycombinator.com/item?id=47809190",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41253.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-41253",
"https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30b884a16617cd5495899f86",
"https://blog.calif.io/p/mad-bugs-even-cat-readmetxt-is-not"
],
"provider_metadata": {
"cwe_ids": [
"CWE-829"
],
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41253.json"
}
},
"related_cves": [
{
"value": "CVE-2026-41253",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 505094,
"published_at": "2026-04-18T05:27:08.202+00:00"
}