6 ms·

For folks who don't use the Tmux integration, are they affected at all? I know that the post details that this occurs during usage of the Tmux integration, but

For folks who don't use the Tmux integration, are they affected at all? I know that the post details that this occurs during usage of the Tmux integration, but is there a possibility that the same vulnerability is present in normal iTerm2 usage (i.e, no Tmux integration)?

gnachman 7y ago
Yes, everyone should upgrade. An exploit would use the tmux integration control sequence without your consent.
- ilikepi 7y ago
  Would you consider a feature request for a setting to disable the tmux integration feature? The exploit seems like good evidence for the need for this. I finally got around to installing iTerm2 this year. It's great, thanks to you (and to all contributors) for all your hard work! I will say, though, that while features like shell integration sound powerful, I personally choose to keep them disabled in order to minimize attack surface. It would be nice to be able to disable tmux integration as well for the same reason, given I don't use tmux. EDIT: clarification
  - gnachman 7y ago
    Yep, good idea. There is an advanced pref to disable potentially risky control sequences. I plan to invest in giving users the option to lock things down more so they can trade off convenience vs security as they see fit
capableweb 7y ago
If you take a look at the demo shown in the blog post, it seems to show that you don't need to run tmux to be vulnerable. The demo video user is just in a normal tab. https://ffp4g1ylyit3jdyti1hqcvtb-wpengine.netdna-ssl.com/security/files/2019/10/cve-2019-9535.webm https://ffp4g1ylyit3jdyti1hqcvtb-wpengine.netdna-ssl.com/sec...