"cat readme.txt" is not safe if you use iTerm2 • Hacker News Board

Re: "cat readme.txt" is not safe if you use iTerm2

#141

Post by anthk » Sat, Apr 18, 2026, 1:40 PM UTC

em-bee wrote: post #65

ori_b wrote: post #49

Earlier quoted context omitted.

Graphics. They're network transparent, and take over the terminal. Terminal apps were obsolete once we had invented the pixel. Unix just provides no good way to write one that can be used remotely.

Unix just provides no good way to write one that can be used remotely well that's the issue, isn't it? the graphics options that we have are slow and complex, and they don't solve the problems like a terminal and therefore the terminal persist.

Plan9 has no terminals. Well, it actually has one in 9front, vt(1), but as a tool to call against Unix systems (such as ssh), not to interact with 9front software. vt(1) in 9front it's as 'native' as HyperTerminal in Windows.

Re: "cat readme.txt" is not safe if you use iTerm2

#142

Post by spacedcowboy » Sat, Apr 18, 2026, 1:51 PM UTC

miki123211 wrote: post #125

KerrickStaley wrote: post #5

> At the time of writing, the fix has not yet reached stable releases. Why was this disclosed before the hole was patched in the stable release? It's only been 18 days since the bug was reported to upstream, which is much shorter than typical vulnerability disclosure deadlines. The upstream commit ( https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30... ) has way less information than this blog post, so I th…

So this bug just proves my thesis about shortening update windows. You may need Claude Mythos to find a hard-to-discover bug in a 30-year-old open source codebase, but that bug will eventually be patched, and that patch will eventually hit the git repo. This lets smaller models rediscover the bug a lot more easily. I won't be surprised if the window between a git commit and active port scans shrinks to hours or maybe…

I found a 20-year old bug in gmime a couple of months or so ago. You don't need to be an AI to do that ...

It also puts the lie to "all bugs are shallow with sufficient eyes", gmime is pretty commonly used, but localeUTF and back were still wrong.

Re: "cat readme.txt" is not safe if you use iTerm2

#143

Post by 6thbit » Sat, Apr 18, 2026, 3:20 PM UTC

saddist0 wrote: post #13

ezoe wrote: post #12

Earlier quoted context omitted.

I guess traditional moratorium period for vulnerability publication is going to be fade away as we rely on AI to find it. If publicly accessible AI model with very cheap fee can find it, it's very natural to assume the attackers had found it already by the same method.

It’s a wrong way to look at things. Just because CIA can know your location (if they want to), would you share live location to everyone on the internet? LLM is a tool, but people still need to know — what where how.

No. You operate AS IF they know your location.

In other words, it becomes part of your threat model.

Re: "cat readme.txt" is not safe if you use iTerm2

#144

Post by srj » Sat, Apr 18, 2026, 3:22 PM UTC

gnachman wrote: post #115

iTerm2 author here. This could be used as a link in an exploit chain but by itself the claim in the title is massively overblown. I’m on a family vacation but I’ll release a fix when I get back.

I love iTerm2, thank you!

Re: "cat readme.txt" is not safe if you use iTerm2

#145

Post by 6thbit » Sat, Apr 18, 2026, 3:24 PM UTC

bawolff wrote: post #41

KerrickStaley wrote: post #5

> At the time of writing, the fix has not yet reached stable releases. Why was this disclosed before the hole was patched in the stable release? It's only been 18 days since the bug was reported to upstream, which is much shorter than typical vulnerability disclosure deadlines. The upstream commit ( https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30... ) has way less information than this blog post, so I th…

Once the commit is public, the cat is out of the bag. Being coy about it only helps attackers and reduces everyone's security.

Yes I think this is an appropriate view today.

My only caveat would be that in some security fixes, the pure code delta, is not always indicative of the full exploit method. But LLMs could interpolate from there depending on context.

Re: "cat readme.txt" is not safe if you use iTerm2

#146

Post by maximilianburke » Sat, Apr 18, 2026, 3:34 PM UTC

KerrickStaley wrote: post #5

> At the time of writing, the fix has not yet reached stable releases. Why was this disclosed before the hole was patched in the stable release? It's only been 18 days since the bug was reported to upstream, which is much shorter than typical vulnerability disclosure deadlines. The upstream commit ( https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30... ) has way less information than this blog post, so I th…

Because malicious actors don't believe in disclosure windows.

Re: "cat readme.txt" is not safe if you use iTerm2

#147

Post by jayofdoom » Sat, Apr 18, 2026, 3:35 PM UTC

These categories of vulnerability are not new: https://dgl.cx/2023/09/ansi-terminal-security -- any time you take any untrusted data and do literally anything with it, you're at risk.

Re: "cat readme.txt" is not safe if you use iTerm2

#148

Post by skydhash » Sat, Apr 18, 2026, 3:37 PM UTC

em-bee wrote: post #68

kps wrote: post #62

Earlier quoted context omitted.

A network-transparent graphics protocol? Who would ever think of such a thing?

that's actually not what i am after. what i envision is a graphical terminal, that is a terminal that uses graphic elements to display the output. consider something like grep on multiple files. it should produce a list of lines found. the graphical terminal takes that list and displays it. it can distinguish the different components of that list, the filenames, the lines matched, the actual match, etc. because it ca…

Isn't that Emacs?

Re: "cat readme.txt" is not safe if you use iTerm2

#149

Post by cryptbe » Sat, Apr 18, 2026, 3:38 PM UTC

KerrickStaley wrote: post #5

> At the time of writing, the fix has not yet reached stable releases. Why was this disclosed before the hole was patched in the stable release? It's only been 18 days since the bug was reported to upstream, which is much shorter than typical vulnerability disclosure deadlines. The upstream commit ( https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30... ) has way less information than this blog post, so I th…

Disclosure: I didn't discover the vulnerability. I wrote the blog post.

>The author was able to develop an exploit by prompting an LLM with just the upstream commit

Yes, I was able to do this. I believe anyone watching iTerm2's commits would be able to do this too.

>but I still think this blog post raises the visibility of the vulnerability.

Yes, I wanted to raise the visibility of the vulnerability, and it works!

The author of iTerm2 initially didn’t consider it severe enough to warrant an immediate release, but they now seem to have reconsidered.

Re: "cat readme.txt" is not safe if you use iTerm2

#150

Post by cryptbe » Sat, Apr 18, 2026, 3:45 PM UTC

gnachman wrote: post #115

iTerm2 author here. This could be used as a link in an exploit chain but by itself the claim in the title is massively overblown. I’m on a family vacation but I’ll release a fix when I get back.

Disclosure: I didn't discover the vulnerability. I wrote the blog post.

Thanks for releasing a fix!

It was surprising that there wasn't an official release, even though the bug impacts otherwise routine, harmless workflows. The patch itself [1] framed the issue as "hypothetical," so the goal of the blog post was to demonstrate that it is not. I'm glad that you've agreed to release a fix.

[1] https://github.com/gnachman/iTerm2/commit/a9e745993c2e2cbb30...