Terminal2Shell Design Flaw Exposes Interactive Shell in All Operating Systems Since 1971

Security researchers have disclosed Terminal2Shell, a critical design-level vulnerability affecting terminal emulators in all operating systems since Unix v1 in 1971. The bug grants any local user who opens a terminal an immediate interactive command shell with the full rights of the current account, requiring no extra authentication beyond what the user has already performed.

Terminal2Shell works because launching a terminal automatically spawns a shell process directly connected to the keyboard. An attacker with local access can therefore execute arbitrary commands, including file deletion, software installation, and configuration changes. Researchers confirmed that commands entered by the legitimate user are also executed by the shell.

Exploitation Steps

• Open the terminal application.
• Begin typing commands.

No second stage exists. A working proof-of-concept is available on the disclosure site; users are invited to click inside the demo area and type help to observe behavior.

Signs of Compromise

Presence of any of the following prompts followed by a blinking cursor indicates compromise: $, %, >, ❯, or #. The # symbol signals root-level access. Recommended immediate actions include disconnecting from the network and society.

Risk Reduction Measures

• Do not open terminals — the most effective control.
• Close terminals immediately after use; the issue returns on next launch.
• Type more slowly to reduce command throughput.
• Disable the physical keyboard (screen keyboards bypass this).
• Set SHELL=/bin/false — eliminates the vulnerability and normal computer use.

Disclosure Timeline

• 1971 — Thompson shell ships with Unix v1 containing the vulnerable code.
• 1979 — Bourne shell released, preserving the issue for backward compatibility.
• 1989 — Bash released; its name reportedly confirms the intentional nature of the attack surface.
• 2009 — zsh gains popularity, adding visual appeal that researchers say attracts more victims.
• 2026 — Coordinated disclosure to all vendors; responses noted “this is how terminals work.”

Key Questions Answered

Every computer and smartphone user is affected. Telemetry shows millions of developers invoke the affected functionality dozens of times per hour, sometimes configured to launch automatically at login. Root access is possible only if the attacker knows the user password; in practice the user is usually the attacker. The vulnerability carries a logo, domain, and numeric name, meeting all criteria for a serious issue. It underpins the entire *2Shell family of flaws.