CVE-2019-9535

A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker to execute arbitrary commands by providing malicious output to the terminal. This affects versions of iTerm2 up to and including 3.3.5. This vulnerability may allow an attacker to execute arbitrary commands on their victim's computer by providing malicious output to the terminal. It could be exploited using command-line utilities that print attacker-controlled content.

• CWE-349
• CWE-74

• https://blog.mozilla.org/security/2019/10/09/iterm2-critical-issue-moss-audit/Exploit, Third Party Advisory
• https://groups.google.com/forum/#%21topic/iterm2-discuss/57k_AuLdQa4
• https://kb.cert.org/vuls/id/763073/Third Party Advisory, US Government Resource
• https://blog.mozilla.org/security/2019/10/09/iterm2-critical-issue-moss-audit/Exploit, Third Party Advisory
• https://groups.google.com/forum/#%21topic/iterm2-discuss/57k_AuLdQa4
• https://kb.cert.org/vuls/id/763073/Third Party Advisory, US Government Resource

Published

Oct 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9529The web application portal of the Cobham EXPLORER 710, firmw…5.5
• CVE-2019-9530The web root directory of the Cobham EXPLORER 710, firmware …5.5
• CVE-2019-9531The web application portal of the Cobham EXPLORER 710, firmw…9.8
• CVE-2019-9532The web application portal of the Cobham EXPLORER 710, firmw…7.8
• CVE-2019-9533The root password of the Cobham EXPLORER 710 is the same for…9.8
• CVE-2019-9534The Cobham EXPLORER 710, firmware version 1.07, does not val…7.8
• CVE-2019-9536Apple iPhone 3GS bootrom malloc implementation returns a non…6.8
• CVE-2019-9537: Improper Neutralization of Input During Web Page Generatio…6.1
• CVE-2019-9538: Improper Neutralization of Input During Web Page Generatio…6.1
• CVE-2019-9539: Improper Neutralization of Input During Web Page Generatio…6.1
• CVE-2019-9540: Improper Neutralization of Input During Web Page Generatio…6.1
• CVE-2019-9541: Information Exposure vulnerability in itemlookup.asp of Te…6.1