An almost identical security issue in iterm2 reported 6 years ago:

https://blog.mozilla.org/security/2019/10/09/iterm2-critical...