High
Security advisory
iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git repositories.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-19022
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:53 UTC · Revision 1
Source evidence
iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git repositories.
osv:CVE-2019-19022
Complete source record
{
"id": "0b6b30ef5d131c6f16cb49a196b7958b74394a82e6d6b81e17bfc19eede5eadc",
"url": "https://osv.dev/vulnerability/CVE-2019-19022",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-19022",
"summary": "iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git repositories.",
"evidence": "osv:CVE-2019-19022",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2019-19022",
"aliases": [
"CVE-2019-19022"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/gnachman/iterm2",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "b316c29f4b2212d181a040db3f5573eb0e556c12"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:iterm2:iterm2:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "3.3.6"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v20190623-nightly",
"v20190829-nightly",
"v3.3.6",
"v20191004-nightly",
"v20190930-nightly",
"v20190929-nightly",
"v3.3.5beta2",
"v20190920-nightly",
"v20190919-nightly",
"v20190917-nightly",
"v20190916-nightly",
"v3.3.5beta1",
"v20190914-nightly",
"v20190913-nightly",
"v20190912-nightly",
"v20190911-nightly",
"v20190909-nightly",
"v3.3.4",
"v3.3.4beta1",
"v20190908-nightly",
"v20190907-nightly",
"v20190906-nightly",
"v20190905-nightly",
"v3.3.3beta2",
"v20190904-nightly",
"v20190828-nightly",
"v20190827-nightly",
"v20190826-nightly",
"v20190825-nightly",
"v20190824-nightly",
"v20190823-nightly",
"v20190822-nightly",
"v20190820-nightly",
"v3.3.3beta1",
"v20190819-nightly",
"v3.3.2beta2",
"v20190818-nightly",
"v20190816-nightly",
"v20190815-nightly",
"v20190814-nightly",
"v20190813-nightly",
"v20190812-nightly",
"v20190810-nightly",
"v20190809-nightly",
"v20190808-nightly",
"v20190807-nightly",
"v3.3.2beta1",
"v20190806-nightly",
"v20190802-nightly",
"v20190801-nightly",
"v3.3.0beta16",
"v20190729-nightly",
"v20190731-nightly",
"v20190728-nightly",
"v20190725-nightly",
"v20190724-nightly",
"v20190722-nightly",
"v3.3.0beta15",
"v20190717-nightly",
"v20190721-nightly",
"v3.3.0beta14",
"v20190719-nightly",
"v20190715-nightly",
"v20190626-nightly",
"v20190625-nightly",
"v3.3.0beta13",
"v20190617-nightly",
"v3.3.0beta12",
"v20190616-nightly",
"v20190615-nightly",
"v20190614-nightly",
"v20190613-nightly",
"v20190610-nightly",
"v3.3.0beta11",
"v20190606-nightly",
"v20190603-nightly",
"v20190604-nightly",
"v3.3.0beta10",
"v20190602-nightly",
"v20190601-nightly",
"v20190531-nightly",
"v20190530-nightly",
"v20190529-nightly",
"v20190528-nightly",
"v3.3.0beta9",
"v20190527-nightly",
"v20190526-nightly",
"v20190523-nightly",
"v20190522-nightly",
"v20190521-nightly",
"v20190520-nightly",
"v3.3.0beta8",
"v20190519-nightly",
"v20190517-nightly",
"v20190516-nightly",
"v20190515-nightly",
"v20190514-nightly",
"v3.3.0beta7",
"v20190512-nightly",
"v20190511-nightly",
"v20190510-nightly",
"v20190508-nightly",
"v20190507-nightly",
"v3.3.0beta6",
"v20190506-nightly",
"v20190502-nightly",
"v20190430-nightly",
"v20190429-nightly",
"v3.3.0beta5",
"v20190428-nightly",
"v20190427-nightly",
"v20190425-nightly",
"v20190424-nightly",
"v20190423-nightly",
"v20190422-nightly",
"v3.3.0beta4",
"v20190421-nightly",
"v20190420-nightly",
"v20190418-nightly",
"v20190415-nightly",
"v3.3.0beta3",
"v20190414-nightly",
"v20190413-nightly",
"v20190412-nightly",
"v20190411-nightly",
"v20190407-nightly",
"v20190405-nightly",
"v20190404-nightly",
"v20190403-nightly",
"v20190402-nightly",
"v20190401-nightly",
"v3.3.0beta2",
"v20190331-nightly",
"v20190329-nightly",
"v20190328-nightly",
"v20190327-nightly",
"v20190326-nightly",
"v20190325-nightly",
"v3.3.0beta1",
"v20190324-nightly",
"v20190323-nightly",
"v20190322-nightly",
"v20190321-nightly",
"v20190320-nightly",
"v20190319-nightly",
"v20190318-nightly",
"v20190317-nightly",
"v20190315-nightly",
"v20190313-nightly",
"v20190312-nightly",
"v20190310-nightly",
"v20190309-nightly",
"v20190308-nightly",
"v20190307-nightly",
"v20190306-nightly",
"v20190304-nightly",
"v20190303-nightly",
"v20190302-nightly",
"v20190228-nightly",
"v20190226-nightly",
"v20190225-nightly",
"v20190224-nightly",
"v20190222-nightly",
"v20190220-nightly",
"v20190219-nightly",
"v20190218-nightly",
"v20190217-nightly",
"v20190215-nightly",
"v20190214-nightly",
"v20190212-nightly",
"v20190211-nightly",
"v20190210-nightly",
"v20190207-nightly",
"v20190206-nightly",
"v20190205-nightly",
"v20190204-nightly",
"v20190203-nightly",
"v20190117-nightly",
"v20190116-nightly",
"v20190115-nightly",
"v20190114-nightly",
"v20190113-nightly",
"v20190112-nightly",
"v20190111-nightly",
"v20190110-nightly",
"v20190109-nightly",
"v20190106-nightly",
"v20190105-nightly",
"v20190104-nightly",
"v20190103-nightly",
"v20190102-nightly",
"v20190101-nightly",
"v20181231-nightly",
"v20181230-nightly",
"v20181229-nightly",
"v20181228-nightly",
"v20181227-nightly",
"v20181226-nightly",
"v20181225-nightly",
"v20181224-nightly",
"v20181223-nightly",
"v20181222-nightly",
"v20181221-nightly",
"v20181220-nightly",
"v20181219-nightly",
"v20181218-nightly",
"v20181217-nightly",
"v20181215-nightly",
"v20181214-nightly",
"v20181213-nightly",
"v20181212-nightly",
"v20181211-nightly",
"v20181210-nightly",
"v20181209-nightly",
"v20181208-nightly",
"v20181207-nightly",
"v20181206-nightly",
"v20181205-nightly",
"v20181204-nightly",
"v20181203-nightly",
"v20181202-nightly",
"v20181201-nightly",
"v20181130-nightly",
"v20181129-nightly",
"v20181128-nightly",
"v20181127-nightly",
"v20181126-nightly",
"v20181125-nightly",
"v20181124-nightly",
"v20181123-nightly",
"v20181122-nightly",
"v20181121-nightly",
"v20181120-nightly",
"v20181119-nightly",
"v20181118-nightly",
"v20181117-nightly",
"v20181116-nightly",
"v20181112-nightly",
"v20181111-nightly",
"v20181110-nightly",
"v20181109-nightly",
"v20181108-nightly",
"v20181107-nightly",
"v20181106-nightly",
"v20181105-nightly",
"v20181104-nightly",
"v20181029-nightly",
"v20181028-nightly",
"v20181027-nightly",
"v20181026-nightly",
"v20181025-nightly",
"v20181024-nightly",
"v20181023-nightly",
"v20181022-nightly",
"v20181021-nightly",
"v20181020-nightly",
"v20181018-nightly",
"v20181016-nightly",
"v20181015-nightly",
"v20181014-nightly",
"v20181013-nightly",
"v20181012-nightly",
"v20181011-nightly",
"v20181010-nightly",
"v20181009-nightly",
"v20181008-nightly",
"v20181007-nightly",
"v20181006-nightly",
"v20181005-nightly",
"v20181004-nightly",
"v20181003-nightly",
"v20181002-nightly",
"v20181001-nightly",
"v20180930-nightly",
"v20180929-nightly",
"v20180928-nightly",
"v20180927-nightly",
"v20180926-nightly",
"v20180925-nightly",
"v20180924-nightly",
"v20180919-nightly",
"v20180918-nightly",
"v3.1.6beta3",
"v3.1.6beta2",
"v3.1.5",
"v3.1.5.beta.2",
"v3.1.5.beta.1",
"v3.1.4.beta.1",
"v3.1.3.beta.1",
"v3.1.3",
"v3.1.2.beta.2",
"v3.1.2.beta.1",
"v3.1.0",
"v3.1.beta.10",
"v3.1.beta.9",
"v3.1.beta.8",
"v3.1.beta.7",
"v3.1.beta.6",
"v3.1.beta.5",
"v3.1.beta.3",
"v3.1.beta.2",
"v3.1.beta.1",
"v3.1.0.beta",
"v3.0.4",
"v+3.0.4",
"v3.0.3",
"v3.0.2",
"v3.0.2-preview",
"v3.0.1-preview",
"v3.0.20160531",
"v3.0.0",
"v2.9.20160523",
"v2.9.20160426",
"v2.9.20160313",
"v2.9.20160102",
"v2.9.20151229",
"v2.9.20151111",
"v1.0.0.20130613",
"v20130302",
"v1.0.0.20130210",
"v1.0.0.20120726",
"v1.0.0.20120203",
"v1.0.0.20120107",
"v1.0.0.20111219",
"v1.0.0.20111020",
"v1.0.0.20111009",
"v1.0.0.20110909",
"v1.0.0.20110907b",
"v1.0.0.20110907",
"v1.0.0.20110828",
"v1.0.0.20110821",
"v1.0.0.20110810",
"v1.0.0.20110804",
"v1.0.0.20110727",
"v1.0.0.20110724"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-19022.json"
}
}
],
"modified": "2026-10-24T10:50:37.631810600Z",
"provider": "osv",
"references": [
"https://gitlab.com/gnachman/iterm2/issues/8491"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-19022",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442359,
"published_at": "2019-11-17T18:15:11.503+00:00"
}