{"id":"CVE-2026-123014","title":"iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by inducing the user to open a crafted URL in i…","summary":"iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by inducing the user to open a crafted URL in i…","severity":"high","cvss":8.7,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-88"],"vendor":"iTerm2","product":"iTerm2","affected":["iTerm2 < 3.7.7beta2"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T05:25:55.141Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-123014","references":[{"url":"https://gitlab.com/gnachman/iterm2/-/commit/f29420ae4d3e0f986ee24ea286885d32af58175a"},{"url":"https://iterm2.com/downloads.html"},{"url":"https://gitlab.com/gnachman/iterm2/-/commit/314ba43920dbce08808c032e89966918090bdf8e"}],"tags":["cve.org","exploit-available"],"ingestedAt":"2026-11-05T21:36:00.775Z","epss":0.00475,"epssPercentile":0.41282,"exploits":{"github":1,"githubRepos":["https://github.com/giki-shergill/CVE-2026-123014---iTerm2-Terminal"],"checkedAt":"2026-11-07T18:08:30.647Z"},"exploitAvailable":true,"slug":"CVE-2026-123014","body":"## Overview\n\niTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by inducing the user to open a crafted URL in iTerm2. Percent-encoded NUL characters survive input sanitization and are subsequently converted to whitespace during command-line parsing, allowing injection of additional arguments to /usr/bin/man. An attacker can inject the -P option to select an attacker-controlled pager command. NOTE: this issue exists because of an incomplete fix for CVE-2023-46321.\n\n## Affected\n\n- `iTerm2 < 3.7.7beta2`\n\n## Remediation\n\nThe maintainer confirms that the fix first shipped in iTerm2 3.7.7beta2 and will be included in the 3.7.7 stable release. The x-man-page: handler now validates manual-page sections and page names against an allowlist of characters. URLs containing NUL or other disallowed characters are rejected with a warning. Users should upgrade to a release containing this fix.","depth":"midnight","depthScore":60,"depthScoreParts":{"impact":47.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":235909,"id":"CVE-2026-123014","ts":1794074911880,"field":"exploit_available","old":"false","new":"true"}]}