- cross-posted to:
- [email protected]
- [email protected]
- [email protected]
- cross-posted to:
- [email protected]
- [email protected]
- [email protected]
Terminal2Shell is a design-level vulnerability in terminal emulators. When a terminal is launched, it immediately spawns a shell process and connects it directly to the user’s keyboard. From there, the attacker can issue arbitrary commands with the full privileges of the logged-in user.
Researchers have confirmed that the shell will execute any command typed into it, including commands that delete files, install software, and modify system configuration. In some cases, the shell has been observed executing commands the user typed themselves.
| Product | Vector | Status |
|---|---|---|
| macOS | Terminal.app, iTerm2, Ghostty, Warp | VULNERABLE |
| Linux | gnome-terminal, Konsole, xterm, Ctrl+Alt+F2 | VULNERABLE |
| Windows | cmd.exe, PowerShell, Windows Terminal, WSL | VULNERABLE |
| FreeBSD / OpenBSD | Literally the default experience | VULNERABLE |
| DEC VT100 (1978) | Physical serial cable | VULNERABLE |
| Your router | SSH, telnet, the little console port on the back | VULNERABLE |
| VS Code | Ctrl+` (one keystroke!) | VULNERABLE |
| Microsoft Paint | None known | Not affected |
You must log in or register to comment.
Just tested my system, and it looks like I’m vulnerable. I’m uninstalling bash to see if th
I deleted the whole /usr/bin to be sur
A # prompt indicates the attacker has obtained root. Disconnect from the network, then from society.
😁
And it was discovered with an LLM by some “vibe coder” (please hold your nose while pronouncing) with curly blonde hair, empty blue eyes, a business degree, and horrible political opinions. In addition, he talks your ear off about the inevitable glorious agentic AI future and how nobody needs RAM and that all resources in the world should be used towards bringing this future to past, with his response to most arguments against him being something along the lines of “resistance is futile”.
Oh. This is a joke.
I’m too tired anymore to know what is real apparently.
Lol yeah. It should have been obvious sooner given how thick it lays the joke on - but I had already entered the “groaning and preparing to power everything down” phase before reading the website.
No privilege elevation? CVE 0
Ha, my stack of punched cards are immune! Now I just need something to read them…
My mum’s old knitting machine takes those!
Time to port Doom to that
A quilt with frames of Doom woven into it would be so cool
- SINGLE PLAYER
- LOCAL MULTIPLAYER
- ADD-ONS
- OPTIONS
- BETHESDA.NET
I’m ashamed it took me THAT long. Only upon opening my yakuake it slowly dawned on me. I really feel dumb now…
Mac OS 9 and earlier are not effected. Clear the the be… bes… (cringe) best OS ever.
Several case studies exist of AI agents autonomously executing the Terminal2Shell exploit in order to alter files and run programs on accessed systems. The only solution is a trillion more dollars in investment.
This is what I’m here for
@Infrapink ngl I first thought this was real and retooted. This should be marked with a CW imho for it being a shitpost
It’s literally in the programmerhumor community 😂
@Guiorgy so? I don’t have reddit. This is fedi, not some bullshit American platform lol
What are you talking about? I don’t know what you use to browse Lemmy, but I use Voyager and it shows clearly that this was posted on the programmerhumor lemmy community/world/instance 😂
@Guiorgy whatever a Lemmy is. Well, its a instance to block is what I’m sure lol
