critical9.8
CVE-2023-46322
iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs.
Impact
iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's initial character may be non-alphanumeric. The hostname's other characters may be outside the set of alphanumeric characters, dash, and period.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Iterm2 | Iterm2 | through 3.4.21 Version 3.5.0 |