In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."
CWE-94 Improper Control of Generation of Code ('Code Injection')