In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-38395.json"