iTerm2 Flaw Turns SSH Escape Sequences Into Arbitrary Code Execution

Researchers disclosed a critical iTerm2 vulnerability where forged terminal escape sequences used by the application's SSH integration can be injected via untrusted text (e.g., files, server banners) to impersonate the remote conductor and cause the local shell to execute attacker-supplied payloads; a fix was pushed on March 31 but had not reached stable releases at the time of reporting, so users should avoid rendering untrusted terminal output or connecting to unfamiliar servers until the update is widely available.