- cross-posted to:
- programmer_humor@programming.dev
- cross-posted to:
- programmer_humor@programming.dev
Terminal2Shell is a design-level vulnerability in terminal emulators. When a terminal is launched, it immediately spawns a shell process and connects it directly to the user’s keyboard. From there, the attacker can issue arbitrary commands with the full privileges of the logged-in user.
Researchers have confirmed that the shell will execute any command typed into it, including commands that delete files, install software, and modify system configuration. In some cases, the shell has been observed executing commands the user typed themselves.
| Product | Vector | Status |
|---|---|---|
| macOS | Terminal.app, iTerm2, Ghostty, Warp | VULNERABLE |
| Linux | gnome-terminal, Konsole, xterm, Ctrl+Alt+F2 | VULNERABLE |
| Windows | cmd.exe, PowerShell, Windows Terminal, WSL | VULNERABLE |
| FreeBSD / OpenBSD | Literally the default experience | VULNERABLE |
| DEC VT100 (1978) | Physical serial cable | VULNERABLE |
| Your router | SSH, telnet, the little console port on the back | VULNERABLE |
| VS Code | Ctrl+` (one keystroke!) | VULNERABLE |
| Microsoft Paint | None known | Not affected |
You must log in or # to comment.
Ha, my stack of punched cards are immune! Now I just need something to read them…
My mum’s old knitting machine takes those!
Time to port Doom to that
Mac OS 9 and earlier are not effected. Clear the the be… bes… (cringe) best OS ever.
Several case studies exist of AI agents autonomously executing the Terminal2Shell exploit in order to alter files and run programs on accessed systems. The only solution is a trillion more dollars in investment.
