iTerm2 Information Disclosure Vulnerability via SSH Integration

An information disclosure vulnerability has been identified in iTerm2 versions 3.5.6 through 3.5.10, prior to 3.5.11. This issue arises in certain it2ssh and SSH Integration configurations, during remote logins to hosts with a common Python installation. The vulnerability allows remote attackers to access sensitive information from terminal commands by reading the /tmp/framer.txt file, which may be exposed to other users on the same host.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information logged by the affected user's terminal commands during SSH sessions.

Remediation

Users are advised to upgrade to iTerm2 version 3.5.11 or 3.5.12beta1 and delete the /tmp/framer.txt file on affected hosts.