iTerm2 3

CVE-2025-22275 is an information leak in iTerm2 3.5.6 through 3.5.10, fixed in 3.5.11 on January 2, 2025. Under specific it2ssh or SSH Integration configurations, iTerm2 logs terminal input and output to /tmp/framer.txt on the remote host, where other users on that host may be able to read it. The vendor says this occurs when the affected iTerm2 versions are used with SSH integration and the remote host has Python 3.7+ in the default path.

The vendor's CRITICAL 9.3 rating badly overstates enterprise risk because this is not an unauthenticated internet-facing remote exploit in the way the CVSS vector implies. In practice, the attacker usually needs access to the same remote system where the victim SSHs, plus a configuration niche that many fleets never use; the real risk is credential and command leakage on shared bastions, jump boxes, and multi-user Unix hosts, not mass remote compromise.

Why this verdict

• Requires a prior foothold on the remote host: the attacker generally needs authenticated access or code execution on the same Unix system where the victim's SSH session lands, which is strong downward pressure from the vendor's 9.3 baseline.
• The reachable population is narrow: exploitation depends on it2ssh or a specific SSH Integration configuration, affected iTerm2 versions, and Python 3.7+ on the remote host. That sharply reduces exposed enterprise population versus a normal network service bug.
• Impact is meaningful but bounded: this can leak commands, outputs, and secrets, especially on shared bastions, but it does not directly give code execution, persistence, or broad unauthenticated access by itself.

Why not higher?

This is not a clean pre-auth internet exploit, and the CVSS vector overstates that badly. The chain assumes a prior compromise stage or legitimate access on the SSH destination plus a niche feature path, so it does not justify a HIGH or CRITICAL fleet posture for most enterprises.

Why not lower?

It is still more than hygiene-level noise because the leaked material can include real credentials, pasted secrets, internal hostnames, and privileged command output. On shared Unix infrastructure, one stray /tmp/framer.txt can hand an already-present attacker the exact data needed for lateral movement.

1. Delete /tmp/framer.txt on shared SSH hosts — Hunt for and remove the remote artifact on bastions, jump boxes, build hosts, and other multi-user Unix systems touched by macOS engineers. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but this cleanup is fast and immediately cuts residual exposure.
2. Disable risky SSH integration paths where feasible — Temporarily stop using it2ssh or profile-driven SSH Integration on shared remote hosts if you cannot verify patch uptake quickly. For MEDIUM, there is no mitigation SLA — go straight to the 365-day remediation window; use this selectively on high-value admin populations rather than as a broad emergency change.
3. Shorten the value of leaked secrets — Prioritize short-lived tokens, MFA-backed SSH access, and rapid rotation for credentials likely to have appeared in terminal sessions. That does not fix the bug, but it reduces the usefulness of anything harvested from /tmp/framer.txt; again, no mitigation SLA — go straight to the 365-day remediation window.
4. Watch reads of the artifact on shared Unix systems — Add a simple file-access watch or EDR analytic for /tmp/framer.txt reads, especially by unexpected users or service accounts. There is no mitigation SLA for a MEDIUM under noisgate, but this gives you a cheap tripwire while patching catches up.

Run this on the managed macOS endpoint where iTerm2 is installed, not on the remote SSH server. Invoke it as bash check_iterm2_cve_2025_22275.sh with a standard user account; no root is required. It checks the installed iTerm2 version against the known affected range and reports VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# check_iterm2_cve_2025_22275.sh
# Detects whether the local macOS host has an iTerm2 version in the affected range
# for CVE-2025-22275 (3.5.6 through 3.5.10, fixed in 3.5.11).
#
# Exit codes:
#   0 = PATCHED / not affected
#   1 = VULNERABLE
#   2 = UNKNOWN / could not determine

set -u

APP_PATHS=(
  "/Applications/iTerm.app"
  "$HOME/Applications/iTerm.app"
)

find_iterm() {
  local p
  for p in "${APP_PATHS[@]}"; do
    if [ -d "$p" ]; then
      echo "$p"
      return 0
    fi
  done
  return 1
}

normalize_version() {
  # Keep first three numeric components; pad missing pieces with zeros
  local v="$1"
  local major minor patch
  v="${v%%[^0-9.]*}"
  IFS='.' read -r major minor patch _rest <<< "$v"
  major=${major:-0}
  minor=${minor:-0}
  patch=${patch:-0}
  echo "$major.$minor.$patch"
}

ver_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

ver_lt() {
  # returns 0 if $1 < $2
  [ "$1" != "$2" ] && [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

APP_PATH="$(find_iterm)"
if [ -z "${APP_PATH:-}" ]; then
  echo "PATCHED: iTerm2 not found in standard locations; this host is not affected by CVE-2025-22275 via local iTerm2."
  exit 0
fi

PLIST="$APP_PATH/Contents/Info.plist"
if [ ! -f "$PLIST" ]; then
  echo "UNKNOWN: Found iTerm2 at '$APP_PATH' but could not locate Info.plist."
  exit 2
fi

RAW_VER="$(/usr/bin/defaults read "$PLIST" CFBundleShortVersionString 2>/dev/null || true)"
if [ -z "$RAW_VER" ]; then
  echo "UNKNOWN: Could not read CFBundleShortVersionString from '$PLIST'."
  exit 2
fi

VER="$(normalize_version "$RAW_VER")"
AFFECTED_START="3.5.6"
FIXED_VER="3.5.11"

if ver_ge "$VER" "$AFFECTED_START" && ver_lt "$VER" "$FIXED_VER"; then
  echo "VULNERABLE: iTerm2 version $VER is within the affected range for CVE-2025-22275."
  echo "NOTE: This check validates the local vulnerable client version only; remote-host artifact cleanup (e.g. /tmp/framer.txt) must be assessed separately."
  exit 1
fi

if ver_ge "$VER" "$FIXED_VER"; then
  echo "PATCHED: iTerm2 version $VER is fixed for CVE-2025-22275."
  exit 0
fi

if ver_lt "$VER" "$AFFECTED_START"; then
  echo "PATCHED: iTerm2 version $VER is older than the known affected range for CVE-2025-22275."
  exit 0
fi

echo "UNKNOWN: Unable to classify iTerm2 version '$RAW_VER' (normalized: '$VER')."
exit 2

Sources

1. iTerm2 3.5.11 release notes / security fix
2. iTerm2 downloads page with 3.5.11 advisory text
3. iTerm2 Shell Integration documentation
4. Official CVE JSON record
5. NVD entry
6. OSV entry with introduced/fixed mapping
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS overview