CVE-2026-88514
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information.
Risk Assessment
A local attacker with system access could read sensitive data, potentially compromising the confidentiality of information processed in the terminal.
Recommendation
Update iTerm2 to version 3.6.12 or later.
Other vulnerabilities in iTerm2
See all- CVE-2015-9231High
iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new feature added in version 3.0.0 results in potential information disclosure by sending text as an unencrypted DNS query.
- CVE-2026-123014High
iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by inducing the user to open a crafted URL. Percent-encoded NUL characters survive input sanitization and are converted to whitespace during command-line parsing, allowing injection of the -P option to select an attacker-controlled pager.
Original NVD description (English source)
An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS