An unverified flaw in iTerm2 for macOS allows a local user to read sensitive data that should be protected. The vulnerability exposes confidential information without authentication or network interaction, implying that an attacker with local privileges could potentially read data stored by iTerm2. The weakness aligns with CWE‑200, which describes information exposure vulnerabilities.

iTerm2 on macOS versions earlier than 3.6.12 are impacted. No other vendors or products are listed as affected.

Because the attack vector is local, an adversary must already have access to the target machine. The CVSS score is 5.5, and the EPSS score is not provided, so the precise likelihood of exploitation cannot be quantified. The vulnerability is not present in the CISA KEV catalog. The known workarounds or mitigations are not given in the description, though a recent commit suggests a patch was applied in a newer release.