---
id: CVE-2026-123014
title: >-
  iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the
  x-man-page: URL handler, allowing an attacker to execute arbitrary commands
  with the privileges of the logged-in user by inducing the user to open a
  crafted URL in i…
summary: >-
  iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the
  x-man-page: URL handler, allowing an attacker to execute arbitrary commands
  with the privileges of the logged-in user by inducing the user to open a
  crafted URL in i…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-88
vendor: iTerm2
product: iTerm2
affected:
  - iTerm2 < 3.7.7beta2
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T05:25:55.141Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123014'
references:
  - url: >-
      https://gitlab.com/gnachman/iterm2/-/commit/f29420ae4d3e0f986ee24ea286885d32af58175a
  - url: 'https://iterm2.com/downloads.html'
  - url: >-
      https://gitlab.com/gnachman/iterm2/-/commit/314ba43920dbce08808c032e89966918090bdf8e
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-11-05T21:36:00.775Z'
epss: 0.00475
epssPercentile: 0.41282
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/giki-shergill/CVE-2026-123014---iTerm2-Terminal'
  checkedAt: '2026-11-07T18:08:30.647Z'
exploitAvailable: true
---

## Overview

iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by inducing the user to open a crafted URL in iTerm2. Percent-encoded NUL characters survive input sanitization and are subsequently converted to whitespace during command-line parsing, allowing injection of additional arguments to /usr/bin/man. An attacker can inject the -P option to select an attacker-controlled pager command. NOTE: this issue exists because of an incomplete fix for CVE-2023-46321.

## Affected

- `iTerm2 < 3.7.7beta2`

## Remediation

The maintainer confirms that the fix first shipped in iTerm2 3.7.7beta2 and will be included in the 3.7.7 stable release. The x-man-page: handler now validates manual-page sections and page names against an allowlist of characters. URLs containing NUL or other disallowed characters are rejected with a warning. Users should upgrade to a release containing this fix.