The vulnerability allows a local attacker to execute arbitrary code when viewing a plain‑text file in iTerm2. It arises because the application accepts SSH conductor escape sequences from terminal output that does not belong to a legitimate conductor session, causing DCS 2000p and OSC 135 sequences to be interpreted. When the working directory contains a specially crafted file whose name matches the expected conductor‑encoded path—such as a name beginning with "ace/c+"—the embedded escape sequences can trigger code execution. This weakness is classified as CWE‑829.

The affected product is iTerm2 from the vendor iTerm2. Versions up to and including 3.6.9 experience the flaw. All earlier releases prior to 3.6.9 are not noted as affected, and no fix version is given in the CVE data.

The CVSS base score of 6.9 indicates moderate severity. The EPSS score of less than 1% suggests low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires a local user to open a .txt file in a directory that contains a maliciously named file, the vector is local. Exploit conditions include presence of properly encoded filename and the ability to view the file content in iTerm2. The overall risk is moderate for users who routinely open untrusted text files from directories that may contain unknown file names.