7 ms·

"cat readme.txt" is not safe if you use iTerm2

318 points by arkadiyt 5mo ago

deleted 5mo ago
[deleted]
Bender 5mo ago
What happens if instead of 'cat readme.txt' one does 'strings -a --unicode=hex readme.txt'? Does iTerm still monkey with it? alias cat cat='strings -a --unicode=hex'
- halJordan 5mo ago
  The whole "cat can hide unprintable characters" is such an old demo. I get this is a novel spin on which unprintable characters were doing but yeah, this was also my thought
  - Bender 5mo ago
    I'm just used to aliasing cat to strings after working around a lot of red-team penetration testers. They would prank each other and me all the time. Had to also watch out for this one [1]. [1] - https://thejh.net/misc/website-terminal-copy-paste https://thejh.net/misc/website-terminal-copy-paste
KerrickStaley 5mo ago
> At the time of writing, the fix has not yet reached stable releases. Why was this disclosed before the hole was patched in the stable release? It's only been 18 days since the bug was reported to upstream, which is much shorter than typical vulnerability disclosure deadlines. The upstream commit (https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30b884a16617cd5495899f86 https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30...) has way less information than this blog post, so I think releasing this blog post now materially increases the chance that this will be exploited in the wild. Update: The author was able to develop an exploit by prompting an LLM with just the upstream commit, but I still think this blog post raises the visibility of the vulnerability.
- ezoe 5mo ago
  I guess traditional moratorium period for vulnerability publication is going to be fade away as we rely on AI to find it. If publicly accessible AI model with very cheap fee can find it, it's very natural to assume the attackers had found it already by the same method.
  - saddist0 5mo ago
    It’s a wrong way to look at things. Just because CIA can know your location (if they want to), would you share live location to everyone on the internet? LLM is a tool, but people still need to know — what where how.
    - lxgr 5mo ago
      Not sure if that's a great example. If there's a catastrophic vulnerability in a widely used tool, I'd sure like to know about it even if the patch is taking some time! The problem with this is that the credible information "there's a bug in widely used tool x" will soon (if not already) be enough to trigger massive token expenditure of various others that will then also discover the bug, so this will often effectively amount to disclosure. I guess the only winning move is to also start using AI to rapidly fix the bugs and have fast release cycles... Which of course has a host of other problems.
      - integralid 5mo ago
        >there's a bug in widely used tool x" There's a security bug in Openssh. I don't know what it is, but I can tell you with statistical certainty that it exists. Go on and do with this information whatever you want.
        mmilunic 5mo ago
        I think in the context of these it’s more of “we’ve discovered a bug” which gives you more information than “there is a bug”. The main difference in information being that the former implies not only there is a bug but that LLMs can find it.
CodesInChaos 5mo ago
I never understood why outputting unescaped data is viewed differently from generating unenclosed html. Like why doesn't `println` in a modern language like rust auto-escape output to a terminal, and require a special `TerminalStr` to output a raw string.
- im3w1l 5mo ago
  I think the problem is that 1) You want to be able to write arbitrary bytes, including shell escape sequences into files. 2) You don't want to accidentally write terminal escape sequences to stdout. 3) Stdout is modeled as a file. Consider cat. It's short for concatenate. It concatenates the files based to it as arguments and writes them to stdout, that may or may not be redirected to a file. If it didn't pass along terminal escapes, it would fail at its job of accurate concatenation. Now I don't mean to dismiss your idea, I do think you are on the right track. The question is just how to do this cleanly given the very entrenched assumptions that lead us where we are.
  - lxgr 5mo ago
    > that may or may not be redirected to a file This is usually knowable. It's a different question whether cat should be doing that, though – it's an extremely low level tool. What's wrong with `less`? (Other than the fact that some Docker images seem to not include it, which is pretty annoying and raises the question as to whether `docker exec` should be filtering escape sequences...)
    - im3w1l 5mo ago
      Sometimes you don't want to open stuff in a pager.
    - tolciho 5mo ago
      Besides less having a lot of code (features, bloat) and therefore attack surface (some less honor LESSSECURE=1 which on some OS these days involves some pretty tight pledge(2) restrictions), or that some vendors have configured less by default to automatically run random code so you can automatically page a gziped file or an attacker can maybe run arbitrary code (whoops!). Besides those issues, and any others I do not know about? Nothing.
TZubiri 5mo ago
More like iTerm2 is not safe
- ButlerianJihad 5mo ago
  A long, long time ago, it was literally possible to stuff the command buffer of a “dumb terminal” using ESC sequences and spoof keyboard input. So yeah, don’t count on ’cat’ being safe if your terminal isn’t!
  - tasty_freeze 5mo ago
    I did this in 1985 on SOROC terminals we had in my first job out of college. However, it depended on the dip switch settings that were under a little door on top of the keyboard.
  - themafia 5mo ago
    > and spoof keyboard input That's because we had terminal side macros. They were awesome in the 1980s.
holoduke 5mo ago
With LLM tool use potentially every cat action could be a prompt injection
jdshaffer 5mo ago
Is it a problem with "cat" or a terminal problem? If I wrote my own version of cat in C, simply reading and displaying a single TXT character at a time, wouldn't I see the same behavior?
- rezonant 5mo ago
  As the article shows, it is a bug in iTerm2. cat is just one program that could trigger it, the key thing is outputting attacker controlled text to the terminal when the attacker can control what files are present (ie unzipping a folder that includes a specific executable file at a well chosen location that gets triggered to run when the readme is output to the terminal)
- readthenotes1 5mo ago
  Give this one MS-DOS shell headline would be " why I never am using Microsoft again" or something dramatic like that. It is a problem in iterm, Apple's overlay, not in the cat program. Program. At least from Reading the article. That's what I got
  - rezonant 5mo ago
    It's actually a third party terminal emulator: https://iterm2.com/ https://iterm2.com/
  - fortran77 5mo ago
    Yes. It’s a Mac problem. That’s why Macs do the worst at pwn2own. It’s compounded by the fact that Mac users deny that there are problems in their beloved OS. cat is a file concatenation utility. UNIX people know to view text files with more.
einpoklum 5mo ago
Even click-baity titles are not safe.
chromacity 5mo ago
This is cool work, but it's also somewhat unsurprising: this is a recurring problem with fancy, richly-featured terminal apps. I think we had at least ten publicly reported vulns of this type in the past 15 years. We also had vulnerabilities in tools such as less, in text editors such as vim, etc. And notably, many of these are logic bugs - i.e., they are not alleviated by a rewrite to Rust. I don't know what to do with this. I think there's this problematic tension between the expectation that on one hand, basic OS-level tools should remain simple and predictable; but on the other hand, that of course we want to have pretty colors, animations, and endless customization in the terminal. And of course, we're now adding AI agents into the mix, so that evil text file might just need to say "disregard previous instructions and...".
- nostrademons 5mo ago
  Makes me wonder if Claude Code has similar vulnerabilities, as it has a pretty rich terminal interface as well. I think the real solution is that you shouldn't try to bolt colors, animations, and other rich interactivity features onto a text-based terminal protocol. You should design it specifically as a GUI protocol to begin with, with everything carefully typed and with well-defined semantics, and avoid using hacks to layer new functionality on top of previously undefined behavior. That prevents whatever remote interface you have from misinterpreting or mixing user-provided data with core UI code. But that flies in the face of how we actually develop software, as well as basic economics. It will almost always be cheaper to adapt something that has widespread adoption into something that looks a little nicer, rather than trying to get widespread adoption for something that looks a little nicer.
  - JSR_FDED 5mo ago
    Spoofing the source of a string that controls colors and animations isn’t really a problem. Spoofing the source of a string that get executed is in an entirely different league.
    - ncr100 5mo ago
      Unless the colors meaningfully change the represented text/information eg hiding or highlighting key details leading to tactically dangerous misinterpretation.
biglio23 5mo ago
[flagged]
Drunk_Engineer 5mo ago
An almost identical security issue in iterm2 reported 6 years ago: https://blog.mozilla.org/security/2019/10/09/iterm2-critical-issue-moss-audit/ https://blog.mozilla.org/security/2019/10/09/iterm2-critical...
- PunchyHamster 5mo ago
  So they learned nothing
  - luckman212 5mo ago
    "They" is 1 guy (George Nachman) who has tirelessly maintained this app in his spare time for 15 years. This is an arms race that's simply impossible for solo devs or even small teams to win. It's going to have a real chilling effect. I've seen a few popular open source projects take themselves private recently (eg cal.com) due to this.
anthk 5mo ago
It is under 9front. There are not terminals, you wan windows with shells on it.
SrslyJosh 5mo ago
[flagged]
valleyer 5mo ago
Wait, so... cat -v not considered harmful, then?
mococa 5mo ago
Is ghostty vulnerable?
- reader9274 5mo ago
  Would be nice if someone ran the steps to reproduce on ghostty
- benatkin 5mo ago
  No, this bug is specific to iTerm2. As for whether there is something as bad for ghostty floating out there, I would hope not. It's a strong goal for it not to be. In Ghostty (and also the terminal I currently use, WezTerm) modularity is prized. What belongs as a clear add-on feature such as this doesn't get to run without being configured first. OTOH, in iTerm2, surprising new features seem to be welcome, if not now, in recent memory. https://news.ycombinator.com/item?id=40458135 https://news.ycombinator.com/item?id=40458135
- 0123456789ABCDE 5mo ago
  likely not but what about other vulns? what about spaceship? zsh or ohmyzsh? time to reduce exposed surface
bananaboy 5mo ago
I used to use iTerm2. I had no idea it was doing all of this behind my back. That’s not what I want my terminal to do!
WalterBright 5mo ago
Back in the PDP-10 days, one communicated with it using a terminal attached to it. One of my fellow students discovered that if you hit backspace enough times, the terminal handler would keep erasing characters before the buffer. Go far enough, and then there was an escape character (Ctrl-u?) that would delete the whole line. Poof went the operating system!
- jml7c5 5mo ago
  That reminds me of "Real Life Tron on an Apple IIgs". There's something so charming about system memory being misinterpreted. https://blog.danielwellman.com/2008/10/real-life-tron-on-an-apple-iigs.html https://blog.danielwellman.com/2008/10/real-life-tron-on-an-...
- tolciho 5mo ago
  control+u for line-kill is probably a recent thing, a random PDF of "The Unix Programming Environment" (Kernighan & Pike, 1984, p.6) has @ as the line-kill character (and # is erase which these days may or may not be control+? (linux often does something wrong with the delete key, unlike the *BSD)).
  - kps 5mo ago
    TOPS-20 used ^U. (That's where BSD got it, along with ^W, whence it percolated into other *nix.)
    - WalterBright 5mo ago
      I was right. It was the ^U! Thank you.
- ButlerianJihad 5mo ago
  [flagged]
  - WalterBright 5mo ago
    LOL. It's a fact. It was discovered by a fellow student.
DonHopkins 5mo ago
I used to leave a file called README in my public ftp directory that just said: README: no such file or directory One glorious day somebody finally sent me email complaining that they could not read the README file. I advised them to use "emacs README" instead of using cat. I was sorely disappointed they never sent me back a thank you note for correctly suggesting that emacs was the solution to their problem. It was my finest moment in passive aggressive emacs evangelism.
rkagerer 5mo ago
Maybe I'm being unfair here, but it sounds like your complicated system (involving bootstrap scripts, a remote conductor agent, and "hijacking" the terminal connection with special escape sequences for command communication) has a subtle bug. Can't say I'm surprised, complexity breeds this sort of thing, especially when using primitives in ways they weren't really intended to be used. > iTerm2 accepts the SSH conductor protocol from terminal output that is not actually coming from a trusted, real conductor session. In other words, untrusted terminal output can impersonate the remote conductor. If I understand correctly, if a textfile (or any other source of content being emitted to the screen, such as server response banners) contains the special codes iTerm2 and the remote conductor use to communicate, they'll be processed and acted upon without verifying they actually came from a trusted remove conductor. Please correct me if I'm mistaken.
rsync 5mo ago
I’ve said this for as long as I’ve been here on hacker news… I want the terminal to be as dumb as possible. I don’t want it to have any understanding of what it is displaying or anscribe any meaning or significance to the character characters it is outputting. The first time apples terminal.app displayed that little lock icon at the ssh password prompt? The hairs on the back of your neck should have stood up.
- rafram 5mo ago
  What you’re describing would be a completely unusable terminal. You’d lose things as basic as the backspace key. And what’s wrong with Terminal.app indicating when it’s suppressing output?
  - rsync 5mo ago
    Terminal.app does not suppress output in my example. The ssh command switches the terminal into no-echo mode with termios flags. Terminal.app, being clever, watches for disabled echo (among other things) and assumes a password is being entered and displays the key icon and enables Secure Event Input. I don't want Terminal.app to be clever.
    - rafram 5mo ago
      Why not?
  - PunchyHamster 5mo ago
    You're talking nonsense. Backspace worked entirely fine on dumb terminals
    - deleted 5mo ago
      [deleted]
tbrownaw 5mo ago
There's been plenty of times that I catted a binary file and broke my terminal settings. Sometimes fixable by running `clear` (without being able to see what I'm typing), sometimes not. And I know PuTTY has a setting for what string is returned in response to some control code, that iirc per standard can be set from some other code. . In general, in-band signaling allows for "fun" tricks. . +++
- WesolyKubeczek 5mo ago
  Ask me how I know what “tput reset” does.
- yjftsjthsd-h 5mo ago
  > Sometimes fixable by running `clear` (without being able to see what I'm typing), sometimes not. Two tips, if I may: Ctrl-l is easier to type. And `reset` is equally hard to type on a broken terminal, but more effective.
  - alienbaby 5mo ago
    Stty sane has also got me out of this hole many times
eviks 5mo ago
> A terminal used to be a real hardware device: a keyboard and screen connected to a machine, with programs reading input from that device and writing output back to it. > A terminal emulator like iTerm2 is the modern software version of that hardware terminal. That's the fundamental fatal flaw of emulating a bad dead hardware design. Are there any attempts to evolve here past all these weird in-band escape sequences leading cats to scratch your face?
- wang_li 5mo ago
  Yes. It’s called the X Window System and it’s been around since the ‘80s. Also the problem here isn’t that iterm2 is trying to emulate terminals, it’s that it’s trying to do something more over the same network connection without making changes to the ssh protocol.
  - em-bee 5mo ago
    X11 or any network transparent graphics protocol doesn't solve the problems that a terminal solves. how do you pipe data through multiple applications in one command using a GUI for example? nobody has been able to solve that in a practical way yet. what we really want is being able to pipe semantic data that can be output to some kind of graphical device/interface that uses that semantic information to display the data using nice graphical interface elements.
    - yjftsjthsd-h 5mo ago
      > how do you pipe data through multiple applications in one command using a GUI for example? nobody has been able to solve that in a practical way yet. How about Arcan? https://arcan-fe.com/2021/04/12/introducing-pipeworld/ https://arcan-fe.com/2021/04/12/introducing-pipeworld/
      - em-bee 5mo ago
        that looks pretty good, except i want to be able to use the pipes on a remote machine, yet still have the output graphically represented locally.
connorboyle 5mo ago
If I were a GNU core utils maintainer, I would not be too happy with this post title
- collinfunk 5mo ago
  I am one of them. The title of the substack seems fine since it mentions "if you use iTerm2". The tweet has no mention of iTerm2 which makes it sound like an issue in 'cat', which is mildly annoying [1]. [1] https://x.com/calif_io/status/2045207168677503241 https://x.com/calif_io/status/2045207168677503241
  - connorboyle 5mo ago
    Thanks for all your work. The post title on 2026-04-18 (when this HN post was made) did not include this qualification: https://web.archive.org/web/20260418153857/https://blog.calif.io/p/mad-bugs-even-cat-readmetxt-is-not https://web.archive.org/web/20260418153857/https://blog.cali...
nine_k 5mo ago
The title is sensationalist; cat is fine. What is unsafe is iTerm's ssh integration, which is pretty obviously unsafe, because it includes a side control channel that is not cleanly separated from the the data stream. Don't use it, use normal ssh, and all should be fine.
- dang 5mo ago
  Ok, we've put the article's let-me-walk-this-back qualifier in the title above. Thanks!
  - cryptbe 5mo ago
    This is a good title, thanks! There was iTerm2 in the original title, but it overflowed to the subtitle in Substack. I've now updated the blog post.
tkel 5mo ago
> The final chunk (ace/c+aliFIo) works if that path exists locally and is executable. Ah yes, the well known c+aliFIo shell script that every developer has. Inside the commonly used "ace" directory. This article is sensationalist. And constructed by an LLM. It's well known that cat'ing binary files can introduce weird terminal escape codes into the session. Not surprised that iTerm's SSH integration is not security perfect.
teddyh 5mo ago
Many years ago, terminal emulators used to allow keyboard rebindings via escape codes. This is why it was then common knowledge to never “cat” untrusted files, and to use a program to display the files instead; either a pager, like “less”, or a text editor.
- jclulow 5mo ago
  I believe there were even more substantial issues in some terminal emulators, where escape sequences could write to arbitrary files or even execute programs. I think it's still very reasonable advice to avoid dumping arbitrary bytes into the terminal stream, even if only to avoid screwing up the state of the terminal.
- m3047 5mo ago
  It some cases it was possible for the server to use escape sequences to "read back" parts of what the terminal displayed.
midtake 5mo ago
I'm tired of iTerm2 - ssh conductor - AI features almost forced on us until the community complained - clickable links I just want a dumb, reliable terminal. Is that too much to ask?
- PunchyHamster 5mo ago
  then don't use it ? There are dozens of alternatives
- frutiger 5mo ago
  Use terminal.app. Since tahoe it supports 24bit colour and has key combos for the most common features.
- AnonymousPlanet 5mo ago
  Clickable paths is the unique feature of iTerm2 I use the most. It's called sematic history, for some reason, and converts a UNIX environment into something like an IDE. I let it trigger a bash script that opens my editor when I click a path in, e.g., a stack trace or in the output of a sequence of piped commands. The developers of Kitty, Ghostty etc. are too much mouse haters to even acknowledge the possibility of this feature, so I'm stuck with iTerm2.
- joshstrange 5mo ago
  > AI features almost forced on us until the community complained This was a wrong take back when it happened and it’s even more silly to bring it up now. No AI features were forced on anyone, it was opt-in and HN lost its mind over a nothing burger. “Oh no! This software has a feature I don’t like which isn’t even enabled by default, whatever will I do?”
- m3047 5mo ago
  nc /s
zx8080 5mo ago
> We'd like to acknowledge OpenAI for partnering with us on this project. OpenAI: sponsor of the today's 0-day.
- jval43 5mo ago
  More like the model knew of the previous, almost identical bug from 6 years ago. Whoever discovered that should be credited.
kstenerud 5mo ago
Glad I dumped iterm2 awhile ago after noticing it tends to have the highest energy impact next to my browser.
hulitu 5mo ago
Programs trying to "execute" every piece of data thrown at them are a pest.
thorn 5mo ago
I would prefer if these would not happen but that is the price for having a rich terminal. I donate to the author of iterm a small sum every month, I wish if he focused on the security for a while and tightened some bugs instead of pushing into AI related features
WhereIsTheTruth 5mo ago
> We'd like to acknowledge OpenAI for partnering with us on this project. AD in disguise
eqvinox 5mo ago
This sounds vaguely familiar. Wasn't iTerm2's SSH integration already the source of a relatively high profile CVE a while back? ⇒ https://nvd.nist.gov/vuln/detail/CVE-2025-22275 https://nvd.nist.gov/vuln/detail/CVE-2025-22275 iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from terminal commands by reading the /tmp/framer.txt file. This can occur for certain it2ssh and SSH Integration configurations, during remote logins to hosts that have a common Python installation. But I thought there was something more… https://news.ycombinator.com/item?id=47811587 https://news.ycombinator.com/item?id=47811587 (this page) was in the tmux integration. Maybe iTerm2 should try a little less hard on these integrations...
- raggi 5mo ago
  multiple times
- WesolyKubeczek 5mo ago
  Which is why I’m also wary of the ghostty’s integration that is supposed to inject its terminfo when you ssh in. How about bloody no and working with upstream ncurses to update the terminfo database?
dark-star 5mo ago
Why does iterm2 need to know the shell and/or python versions on the other side? What happens if the othe side is a system that doesn't "understand" its bootstrap script (like a network switch or just some weird shell)? What does iterm2 do with all that information, why does it need it? I don't get it
boomlinde 5mo ago
Older example of security mishaps in iTerm2's SSH integration: https://iterm2.com/downloads/stable/iTerm2-3_5_11.changelog https://iterm2.com/downloads/stable/iTerm2-3_5_11.changelog
gnachman 5mo ago
iTerm2 author here. This could be used as a link in an exploit chain but by itself the claim in the title is massively overblown. I’m on a family vacation but I’ll release a fix when I get back.
- srj 5mo ago
  I love iTerm2, thank you!
- cryptbe 5mo ago
  Disclosure: I didn't discover the vulnerability. I wrote the blog post. Thanks for releasing a fix! It was surprising that there wasn't an official release, even though the bug impacts otherwise routine, harmless workflows. The patch itself [1] framed the issue as "hypothetical," so the goal of the blog post was to demonstrate that it is not. I'm glad that you've agreed to release a fix. [1] https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30b884a16617cd5495899f86 https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30...
- hmokiguess 5mo ago
  Thank you for iTerm2, I appreciate your response here, enjoy your vacation!
xg15 5mo ago
SSH can do port forwards. Why does the conductor/iTerm2 interaction have to run over the normal shell at all?
WesolyKubeczek 5mo ago
One reason I still prefer iTerm2 or Ghostty over Terminal.app is that it has way saner settings for what the word boundaries are, and it lets me select whole paths by double clicking on them. If there was a way to change it for the default terminal, I would just be using it.
cremer 5mo ago
Barely anyone mentioned the "AI agent angle", I mean the situation when an AI agent runs "cat readme.txt" a file with embedded instructions becomes a prompt injection attack. It is the same vulnerability class out-of-band data smuggled through an in-band channel, just targeting the different parser. Terminal security guys have been fighting this for decades and the AI guys are about to rediscover it
jayofdoom 5mo ago
These categories of vulnerability are not new: https://dgl.cx/2023/09/ansi-terminal-security https://dgl.cx/2023/09/ansi-terminal-security -- any time you take any untrusted data and do literally anything with it, you're at risk.
ptx 5mo ago
Hmm. So the issue is, says the article, that: > iTerm2 accepts the SSH conductor protocol from terminal output that is not actually coming from a trusted, real conductor session. In other words, untrusted terminal output can impersonate the remote conductor. ...which, the article strongly implies, but does not explicitly state, results in code execution on the local client machine. But what about the case when it's working as designed, when the output does come from the remote conductor? It sounds like the server, where the conductor is running, is in that case trusted to execute arbitrary code on the client? Assuming the client doesn't use some sort of remote attestation, how can the remote conductor really be trusted?
f30e3dfed1c9 5mo ago
I think this article is horribly written. The second paragraph, in its entirety, reads: > It turns out that it is NOT, if you use iTerm2. And as far as I can tell, that is a vast overstatement. I think an actually true statement would be "It may not be, if you use iTerm2 and its optional 'Shell Integration' feature." As far as I can tell, the "Shell Integration" feature under discussion is entirely optional and disabled by default. If it's not enabled, then there is no problem here. End of story. Happy to be corrected if I'm wrong about this.
- anamexis 5mo ago
  The entire article is "horribly written" based on that one overstatement?
  - f30e3dfed1c9 5mo ago
    Pretty much, yes. It is meant to be the takeaway from the article and as far as I can tell, the statement as written is false. Pretty serious problem, I think.
    - anamexis 5mo ago
      I would say iTerm 2 has a pretty serious problem. A detailed analysis of the issue having a sentence implying it affects all users rather than many or most users is a minor problem.
      - f30e3dfed1c9 5mo ago
        I agree that the problem in iTerm2 is serious. I do not agree that having the takeway sentence in the article being false is a "minor problem." I cannot speculate on what fraction of iTerm2 users enable this optional feature. Is it "many or most"? No idea. I note that the article nowhere mentions the fact that the feature is optional. That would be a huge improvement. We can disagree over whether the article is horribly written or not. My firm opinion is that it is.

318 points by arkadiyt 5mo ago

deleted 5mo ago

[deleted]

What happens if instead of 'cat readme.txt' one does 'strings -a --unicode=hex readme.txt'? Does iTerm still monkey with it? alias cat cat='strings -a --unicode=hex'

halJordan 5mo ago
The whole "cat can hide unprintable characters" is such an old demo. I get this is a novel spin on which unprintable characters were doing but yeah, this was also my thought
- Bender 5mo ago
  I'm just used to aliasing cat to strings after working around a lot of red-team penetration testers. They would prank each other and me all the time. Had to also watch out for this one [1]. [1] - https://thejh.net/misc/website-terminal-copy-paste https://thejh.net/misc/website-terminal-copy-paste

KerrickStaley 5mo ago

> At the time of writing, the fix has not yet reached stable releases. Why was this disclosed before the hole was patched in the stable release? It's only been 18 days since the bug was reported to upstream, which is much shorter than typical vulnerability disclosure deadlines. The upstream commit (https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30b884a16617cd5495899f86 https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30...) has way less information than this blog post, so I think releasing this blog post now materially increases the chance that this will be exploited in the wild. Update: The author was able to develop an exploit by prompting an LLM with just the upstream commit, but I still think this blog post raises the visibility of the vulnerability.

ezoe 5mo ago
I guess traditional moratorium period for vulnerability publication is going to be fade away as we rely on AI to find it. If publicly accessible AI model with very cheap fee can find it, it's very natural to assume the attackers had found it already by the same method.
- saddist0 5mo ago
  It’s a wrong way to look at things. Just because CIA can know your location (if they want to), would you share live location to everyone on the internet? LLM is a tool, but people still need to know — what where how.
  - lxgr 5mo ago
    Not sure if that's a great example. If there's a catastrophic vulnerability in a widely used tool, I'd sure like to know about it even if the patch is taking some time! The problem with this is that the credible information "there's a bug in widely used tool x" will soon (if not already) be enough to trigger massive token expenditure of various others that will then also discover the bug, so this will often effectively amount to disclosure. I guess the only winning move is to also start using AI to rapidly fix the bugs and have fast release cycles... Which of course has a host of other problems.
    - integralid 5mo ago
      >there's a bug in widely used tool x" There's a security bug in Openssh. I don't know what it is, but I can tell you with statistical certainty that it exists. Go on and do with this information whatever you want.
      - mmilunic 5mo ago
        I think in the context of these it’s more of “we’ve discovered a bug” which gives you more information than “there is a bug”. The main difference in information being that the former implies not only there is a bug but that LLMs can find it.

CodesInChaos 5mo ago

I never understood why outputting unescaped data is viewed differently from generating unenclosed html. Like why doesn't `println` in a modern language like rust auto-escape output to a terminal, and require a special `TerminalStr` to output a raw string.

im3w1l 5mo ago
I think the problem is that 1) You want to be able to write arbitrary bytes, including shell escape sequences into files. 2) You don't want to accidentally write terminal escape sequences to stdout. 3) Stdout is modeled as a file. Consider cat. It's short for concatenate. It concatenates the files based to it as arguments and writes them to stdout, that may or may not be redirected to a file. If it didn't pass along terminal escapes, it would fail at its job of accurate concatenation. Now I don't mean to dismiss your idea, I do think you are on the right track. The question is just how to do this cleanly given the very entrenched assumptions that lead us where we are.
- lxgr 5mo ago
  > that may or may not be redirected to a file This is usually knowable. It's a different question whether cat should be doing that, though – it's an extremely low level tool. What's wrong with `less`? (Other than the fact that some Docker images seem to not include it, which is pretty annoying and raises the question as to whether `docker exec` should be filtering escape sequences...)
  - im3w1l 5mo ago
    Sometimes you don't want to open stuff in a pager.
  - tolciho 5mo ago
    Besides less having a lot of code (features, bloat) and therefore attack surface (some less honor LESSSECURE=1 which on some OS these days involves some pretty tight pledge(2) restrictions), or that some vendors have configured less by default to automatically run random code so you can automatically page a gziped file or an attacker can maybe run arbitrary code (whoops!). Besides those issues, and any others I do not know about? Nothing.

TZubiri 5mo ago

More like iTerm2 is not safe

ButlerianJihad 5mo ago
A long, long time ago, it was literally possible to stuff the command buffer of a “dumb terminal” using ESC sequences and spoof keyboard input. So yeah, don’t count on ’cat’ being safe if your terminal isn’t!
- tasty_freeze 5mo ago
  I did this in 1985 on SOROC terminals we had in my first job out of college. However, it depended on the dip switch settings that were under a little door on top of the keyboard.
- themafia 5mo ago
  > and spoof keyboard input That's because we had terminal side macros. They were awesome in the 1980s.

holoduke 5mo ago

With LLM tool use potentially every cat action could be a prompt injection

jdshaffer 5mo ago

Is it a problem with "cat" or a terminal problem? If I wrote my own version of cat in C, simply reading and displaying a single TXT character at a time, wouldn't I see the same behavior?

rezonant 5mo ago
As the article shows, it is a bug in iTerm2. cat is just one program that could trigger it, the key thing is outputting attacker controlled text to the terminal when the attacker can control what files are present (ie unzipping a folder that includes a specific executable file at a well chosen location that gets triggered to run when the readme is output to the terminal)
readthenotes1 5mo ago
Give this one MS-DOS shell headline would be " why I never am using Microsoft again" or something dramatic like that. It is a problem in iterm, Apple's overlay, not in the cat program. Program. At least from Reading the article. That's what I got
- rezonant 5mo ago
  It's actually a third party terminal emulator: https://iterm2.com/ https://iterm2.com/
- fortran77 5mo ago
  Yes. It’s a Mac problem. That’s why Macs do the worst at pwn2own. It’s compounded by the fact that Mac users deny that there are problems in their beloved OS. cat is a file concatenation utility. UNIX people know to view text files with more.

einpoklum 5mo ago

Even click-baity titles are not safe.

chromacity 5mo ago

This is cool work, but it's also somewhat unsurprising: this is a recurring problem with fancy, richly-featured terminal apps. I think we had at least ten publicly reported vulns of this type in the past 15 years. We also had vulnerabilities in tools such as less, in text editors such as vim, etc. And notably, many of these are logic bugs - i.e., they are not alleviated by a rewrite to Rust. I don't know what to do with this. I think there's this problematic tension between the expectation that on one hand, basic OS-level tools should remain simple and predictable; but on the other hand, that of course we want to have pretty colors, animations, and endless customization in the terminal. And of course, we're now adding AI agents into the mix, so that evil text file might just need to say "disregard previous instructions and...".

nostrademons 5mo ago
Makes me wonder if Claude Code has similar vulnerabilities, as it has a pretty rich terminal interface as well. I think the real solution is that you shouldn't try to bolt colors, animations, and other rich interactivity features onto a text-based terminal protocol. You should design it specifically as a GUI protocol to begin with, with everything carefully typed and with well-defined semantics, and avoid using hacks to layer new functionality on top of previously undefined behavior. That prevents whatever remote interface you have from misinterpreting or mixing user-provided data with core UI code. But that flies in the face of how we actually develop software, as well as basic economics. It will almost always be cheaper to adapt something that has widespread adoption into something that looks a little nicer, rather than trying to get widespread adoption for something that looks a little nicer.
- JSR_FDED 5mo ago
  Spoofing the source of a string that controls colors and animations isn’t really a problem. Spoofing the source of a string that get executed is in an entirely different league.
  - ncr100 5mo ago
    Unless the colors meaningfully change the represented text/information eg hiding or highlighting key details leading to tactically dangerous misinterpretation.

biglio23 5mo ago

[flagged]

Drunk_Engineer 5mo ago

An almost identical security issue in iterm2 reported 6 years ago: https://blog.mozilla.org/security/2019/10/09/iterm2-critical-issue-moss-audit/ https://blog.mozilla.org/security/2019/10/09/iterm2-critical...

PunchyHamster 5mo ago
So they learned nothing
- luckman212 5mo ago
  "They" is 1 guy (George Nachman) who has tirelessly maintained this app in his spare time for 15 years. This is an arms race that's simply impossible for solo devs or even small teams to win. It's going to have a real chilling effect. I've seen a few popular open source projects take themselves private recently (eg cal.com) due to this.

anthk 5mo ago

It is under 9front. There are not terminals, you wan windows with shells on it.

SrslyJosh 5mo ago

[flagged]

valleyer 5mo ago

Wait, so... cat -v not considered harmful, then?

mococa 5mo ago

Is ghostty vulnerable?

reader9274 5mo ago
Would be nice if someone ran the steps to reproduce on ghostty
benatkin 5mo ago
No, this bug is specific to iTerm2. As for whether there is something as bad for ghostty floating out there, I would hope not. It's a strong goal for it not to be. In Ghostty (and also the terminal I currently use, WezTerm) modularity is prized. What belongs as a clear add-on feature such as this doesn't get to run without being configured first. OTOH, in iTerm2, surprising new features seem to be welcome, if not now, in recent memory. https://news.ycombinator.com/item?id=40458135 https://news.ycombinator.com/item?id=40458135
0123456789ABCDE 5mo ago
likely not but what about other vulns? what about spaceship? zsh or ohmyzsh? time to reduce exposed surface

bananaboy 5mo ago

I used to use iTerm2. I had no idea it was doing all of this behind my back. That’s not what I want my terminal to do!

WalterBright 5mo ago

Back in the PDP-10 days, one communicated with it using a terminal attached to it. One of my fellow students discovered that if you hit backspace enough times, the terminal handler would keep erasing characters before the buffer. Go far enough, and then there was an escape character (Ctrl-u?) that would delete the whole line. Poof went the operating system!

jml7c5 5mo ago
That reminds me of "Real Life Tron on an Apple IIgs". There's something so charming about system memory being misinterpreted. https://blog.danielwellman.com/2008/10/real-life-tron-on-an-apple-iigs.html https://blog.danielwellman.com/2008/10/real-life-tron-on-an-...
tolciho 5mo ago
control+u for line-kill is probably a recent thing, a random PDF of "The Unix Programming Environment" (Kernighan & Pike, 1984, p.6) has @ as the line-kill character (and # is erase which these days may or may not be control+? (linux often does something wrong with the delete key, unlike the *BSD)).
- kps 5mo ago
  TOPS-20 used ^U. (That's where BSD got it, along with ^W, whence it percolated into other *nix.)
  - WalterBright 5mo ago
    I was right. It was the ^U! Thank you.
ButlerianJihad 5mo ago
[flagged]
- WalterBright 5mo ago
  LOL. It's a fact. It was discovered by a fellow student.

DonHopkins 5mo ago

I used to leave a file called README in my public ftp directory that just said: README: no such file or directory One glorious day somebody finally sent me email complaining that they could not read the README file. I advised them to use "emacs README" instead of using cat. I was sorely disappointed they never sent me back a thank you note for correctly suggesting that emacs was the solution to their problem. It was my finest moment in passive aggressive emacs evangelism.

rkagerer 5mo ago

Maybe I'm being unfair here, but it sounds like your complicated system (involving bootstrap scripts, a remote conductor agent, and "hijacking" the terminal connection with special escape sequences for command communication) has a subtle bug. Can't say I'm surprised, complexity breeds this sort of thing, especially when using primitives in ways they weren't really intended to be used. > iTerm2 accepts the SSH conductor protocol from terminal output that is not actually coming from a trusted, real conductor session. In other words, untrusted terminal output can impersonate the remote conductor. If I understand correctly, if a textfile (or any other source of content being emitted to the screen, such as server response banners) contains the special codes iTerm2 and the remote conductor use to communicate, they'll be processed and acted upon without verifying they actually came from a trusted remove conductor. Please correct me if I'm mistaken.

rsync 5mo ago

I’ve said this for as long as I’ve been here on hacker news… I want the terminal to be as dumb as possible. I don’t want it to have any understanding of what it is displaying or anscribe any meaning or significance to the character characters it is outputting. The first time apples terminal.app displayed that little lock icon at the ssh password prompt? The hairs on the back of your neck should have stood up.

rafram 5mo ago
What you’re describing would be a completely unusable terminal. You’d lose things as basic as the backspace key. And what’s wrong with Terminal.app indicating when it’s suppressing output?
- rsync 5mo ago
  Terminal.app does not suppress output in my example. The ssh command switches the terminal into no-echo mode with termios flags. Terminal.app, being clever, watches for disabled echo (among other things) and assumes a password is being entered and displays the key icon and enables Secure Event Input. I don't want Terminal.app to be clever.
  - rafram 5mo ago
    Why not?
- PunchyHamster 5mo ago
  You're talking nonsense. Backspace worked entirely fine on dumb terminals
  - deleted 5mo ago
    [deleted]

tbrownaw 5mo ago

There's been plenty of times that I catted a binary file and broke my terminal settings. Sometimes fixable by running `clear` (without being able to see what I'm typing), sometimes not. And I know PuTTY has a setting for what string is returned in response to some control code, that iirc per standard can be set from some other code. . In general, in-band signaling allows for "fun" tricks. . +++

WesolyKubeczek 5mo ago
Ask me how I know what “tput reset” does.
yjftsjthsd-h 5mo ago
> Sometimes fixable by running `clear` (without being able to see what I'm typing), sometimes not. Two tips, if I may: Ctrl-l is easier to type. And `reset` is equally hard to type on a broken terminal, but more effective.
- alienbaby 5mo ago
  Stty sane has also got me out of this hole many times

eviks 5mo ago

> A terminal used to be a real hardware device: a keyboard and screen connected to a machine, with programs reading input from that device and writing output back to it. > A terminal emulator like iTerm2 is the modern software version of that hardware terminal. That's the fundamental fatal flaw of emulating a bad dead hardware design. Are there any attempts to evolve here past all these weird in-band escape sequences leading cats to scratch your face?

wang_li 5mo ago
Yes. It’s called the X Window System and it’s been around since the ‘80s. Also the problem here isn’t that iterm2 is trying to emulate terminals, it’s that it’s trying to do something more over the same network connection without making changes to the ssh protocol.
- em-bee 5mo ago
  X11 or any network transparent graphics protocol doesn't solve the problems that a terminal solves. how do you pipe data through multiple applications in one command using a GUI for example? nobody has been able to solve that in a practical way yet. what we really want is being able to pipe semantic data that can be output to some kind of graphical device/interface that uses that semantic information to display the data using nice graphical interface elements.
  - yjftsjthsd-h 5mo ago
    > how do you pipe data through multiple applications in one command using a GUI for example? nobody has been able to solve that in a practical way yet. How about Arcan? https://arcan-fe.com/2021/04/12/introducing-pipeworld/ https://arcan-fe.com/2021/04/12/introducing-pipeworld/
    - em-bee 5mo ago
      that looks pretty good, except i want to be able to use the pipes on a remote machine, yet still have the output graphically represented locally.

connorboyle 5mo ago

If I were a GNU core utils maintainer, I would not be too happy with this post title

collinfunk 5mo ago
I am one of them. The title of the substack seems fine since it mentions "if you use iTerm2". The tweet has no mention of iTerm2 which makes it sound like an issue in 'cat', which is mildly annoying [1]. [1] https://x.com/calif_io/status/2045207168677503241 https://x.com/calif_io/status/2045207168677503241
- connorboyle 5mo ago
  Thanks for all your work. The post title on 2026-04-18 (when this HN post was made) did not include this qualification: https://web.archive.org/web/20260418153857/https://blog.calif.io/p/mad-bugs-even-cat-readmetxt-is-not https://web.archive.org/web/20260418153857/https://blog.cali...

nine_k 5mo ago

The title is sensationalist; cat is fine. What is unsafe is iTerm's ssh integration, which is pretty obviously unsafe, because it includes a side control channel that is not cleanly separated from the the data stream. Don't use it, use normal ssh, and all should be fine.

dang 5mo ago
Ok, we've put the article's let-me-walk-this-back qualifier in the title above. Thanks!
- cryptbe 5mo ago
  This is a good title, thanks! There was iTerm2 in the original title, but it overflowed to the subtitle in Substack. I've now updated the blog post.

tkel 5mo ago

> The final chunk (ace/c+aliFIo) works if that path exists locally and is executable. Ah yes, the well known c+aliFIo shell script that every developer has. Inside the commonly used "ace" directory. This article is sensationalist. And constructed by an LLM. It's well known that cat'ing binary files can introduce weird terminal escape codes into the session. Not surprised that iTerm's SSH integration is not security perfect.

teddyh 5mo ago

Many years ago, terminal emulators used to allow keyboard rebindings via escape codes. This is why it was then common knowledge to never “cat” untrusted files, and to use a program to display the files instead; either a pager, like “less”, or a text editor.

jclulow 5mo ago
I believe there were even more substantial issues in some terminal emulators, where escape sequences could write to arbitrary files or even execute programs. I think it's still very reasonable advice to avoid dumping arbitrary bytes into the terminal stream, even if only to avoid screwing up the state of the terminal.
m3047 5mo ago
It some cases it was possible for the server to use escape sequences to "read back" parts of what the terminal displayed.

midtake 5mo ago

I'm tired of iTerm2 - ssh conductor - AI features almost forced on us until the community complained - clickable links I just want a dumb, reliable terminal. Is that too much to ask?

PunchyHamster 5mo ago
then don't use it ? There are dozens of alternatives
frutiger 5mo ago
Use terminal.app. Since tahoe it supports 24bit colour and has key combos for the most common features.
AnonymousPlanet 5mo ago
Clickable paths is the unique feature of iTerm2 I use the most. It's called sematic history, for some reason, and converts a UNIX environment into something like an IDE. I let it trigger a bash script that opens my editor when I click a path in, e.g., a stack trace or in the output of a sequence of piped commands. The developers of Kitty, Ghostty etc. are too much mouse haters to even acknowledge the possibility of this feature, so I'm stuck with iTerm2.
joshstrange 5mo ago
> AI features almost forced on us until the community complained This was a wrong take back when it happened and it’s even more silly to bring it up now. No AI features were forced on anyone, it was opt-in and HN lost its mind over a nothing burger. “Oh no! This software has a feature I don’t like which isn’t even enabled by default, whatever will I do?”
m3047 5mo ago
nc /s

zx8080 5mo ago

> We'd like to acknowledge OpenAI for partnering with us on this project. OpenAI: sponsor of the today's 0-day.

jval43 5mo ago
More like the model knew of the previous, almost identical bug from 6 years ago. Whoever discovered that should be credited.

kstenerud 5mo ago

Glad I dumped iterm2 awhile ago after noticing it tends to have the highest energy impact next to my browser.

hulitu 5mo ago

Programs trying to "execute" every piece of data thrown at them are a pest.

thorn 5mo ago

I would prefer if these would not happen but that is the price for having a rich terminal. I donate to the author of iterm a small sum every month, I wish if he focused on the security for a while and tightened some bugs instead of pushing into AI related features

WhereIsTheTruth 5mo ago

> We'd like to acknowledge OpenAI for partnering with us on this project. AD in disguise

eqvinox 5mo ago

This sounds vaguely familiar. Wasn't iTerm2's SSH integration already the source of a relatively high profile CVE a while back? ⇒ https://nvd.nist.gov/vuln/detail/CVE-2025-22275 https://nvd.nist.gov/vuln/detail/CVE-2025-22275 iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from terminal commands by reading the /tmp/framer.txt file. This can occur for certain it2ssh and SSH Integration configurations, during remote logins to hosts that have a common Python installation. But I thought there was something more… https://news.ycombinator.com/item?id=47811587 https://news.ycombinator.com/item?id=47811587 (this page) was in the tmux integration. Maybe iTerm2 should try a little less hard on these integrations...

raggi 5mo ago
multiple times
WesolyKubeczek 5mo ago
Which is why I’m also wary of the ghostty’s integration that is supposed to inject its terminfo when you ssh in. How about bloody no and working with upstream ncurses to update the terminfo database?

dark-star 5mo ago

Why does iterm2 need to know the shell and/or python versions on the other side? What happens if the othe side is a system that doesn't "understand" its bootstrap script (like a network switch or just some weird shell)? What does iterm2 do with all that information, why does it need it? I don't get it

boomlinde 5mo ago

Older example of security mishaps in iTerm2's SSH integration: https://iterm2.com/downloads/stable/iTerm2-3_5_11.changelog https://iterm2.com/downloads/stable/iTerm2-3_5_11.changelog

gnachman 5mo ago

iTerm2 author here. This could be used as a link in an exploit chain but by itself the claim in the title is massively overblown. I’m on a family vacation but I’ll release a fix when I get back.

srj 5mo ago
I love iTerm2, thank you!
cryptbe 5mo ago
Disclosure: I didn't discover the vulnerability. I wrote the blog post. Thanks for releasing a fix! It was surprising that there wasn't an official release, even though the bug impacts otherwise routine, harmless workflows. The patch itself [1] framed the issue as "hypothetical," so the goal of the blog post was to demonstrate that it is not. I'm glad that you've agreed to release a fix. [1] https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30b884a16617cd5495899f86 https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30...
hmokiguess 5mo ago
Thank you for iTerm2, I appreciate your response here, enjoy your vacation!

xg15 5mo ago

SSH can do port forwards. Why does the conductor/iTerm2 interaction have to run over the normal shell at all?

WesolyKubeczek 5mo ago

One reason I still prefer iTerm2 or Ghostty over Terminal.app is that it has way saner settings for what the word boundaries are, and it lets me select whole paths by double clicking on them. If there was a way to change it for the default terminal, I would just be using it.

cremer 5mo ago

Barely anyone mentioned the "AI agent angle", I mean the situation when an AI agent runs "cat readme.txt" a file with embedded instructions becomes a prompt injection attack. It is the same vulnerability class out-of-band data smuggled through an in-band channel, just targeting the different parser. Terminal security guys have been fighting this for decades and the AI guys are about to rediscover it

jayofdoom 5mo ago

These categories of vulnerability are not new: https://dgl.cx/2023/09/ansi-terminal-security https://dgl.cx/2023/09/ansi-terminal-security -- any time you take any untrusted data and do literally anything with it, you're at risk.

ptx 5mo ago

Hmm. So the issue is, says the article, that: > iTerm2 accepts the SSH conductor protocol from terminal output that is not actually coming from a trusted, real conductor session. In other words, untrusted terminal output can impersonate the remote conductor. ...which, the article strongly implies, but does not explicitly state, results in code execution on the local client machine. But what about the case when it's working as designed, when the output does come from the remote conductor? It sounds like the server, where the conductor is running, is in that case trusted to execute arbitrary code on the client? Assuming the client doesn't use some sort of remote attestation, how can the remote conductor really be trusted?

f30e3dfed1c9 5mo ago

I think this article is horribly written. The second paragraph, in its entirety, reads: > It turns out that it is NOT, if you use iTerm2. And as far as I can tell, that is a vast overstatement. I think an actually true statement would be "It may not be, if you use iTerm2 and its optional 'Shell Integration' feature." As far as I can tell, the "Shell Integration" feature under discussion is entirely optional and disabled by default. If it's not enabled, then there is no problem here. End of story. Happy to be corrected if I'm wrong about this.

anamexis 5mo ago
The entire article is "horribly written" based on that one overstatement?
- f30e3dfed1c9 5mo ago
  Pretty much, yes. It is meant to be the takeaway from the article and as far as I can tell, the statement as written is false. Pretty serious problem, I think.
  - anamexis 5mo ago
    I would say iTerm 2 has a pretty serious problem. A detailed analysis of the issue having a sentence implying it affects all users rather than many or most users is a minor problem.
    - f30e3dfed1c9 5mo ago
      I agree that the problem in iTerm2 is serious. I do not agree that having the takeway sentence in the article being false is a "minor problem." I cannot speculate on what fraction of iTerm2 users enable this optional feature. Is it "many or most"? No idea. I note that the article nowhere mentions the fact that the feature is optional. That would be a huge improvement. We can disagree over whether the article is horribly written or not. My firm opinion is that it is.