CVE-2026-123014
Received Received - Intake

Argument Injection in iTerm2 via x-man-page URL Handler

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: MITRE

Description
iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by inducing the user to open a crafted URL in iTerm2. Percent-encoded NUL characters survive input sanitization and are subsequently converted to whitespace during command-line parsing, allowing injection of additional arguments to /usr/bin/man. An attacker can inject the -P option to select an attacker-controlled pager command. NOTE: this issue exists because of an incomplete fix for CVE-2023-46321.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-123014
EUVD
EUVD-2026-117332

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
iTerm2 iTerm2 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

iTerm2 before version 3.7.7beta2 has an argument injection vulnerability in the x-man-page URL handler. Attackers can execute arbitrary commands with the user's privileges by tricking the user into opening a crafted URL. Percent-encoded NUL characters bypass input sanitization and are converted to whitespace during command parsing, allowing additional arguments to be injected into /usr/bin/man. The attacker can then specify a malicious pager command using the -P option.

Detection Guidance

To detect this vulnerability, check the version of iTerm2 installed on your system. If you are using a version prior to 3.7.7beta2, your system is vulnerable. Run the command: defaults read /Applications/iTerm.app/Contents/Info.plist CFBundleVersion to check the version.

Impact Analysis

This vulnerability allows an attacker to run arbitrary commands on your system with your user privileges. If you use iTerm2 and open a specially crafted URL, the attacker could take control of your terminal session, access sensitive files, install malware, or perform other malicious actions without your knowledge.

Compliance Impact

This vulnerability allows arbitrary command execution via crafted URLs, which could lead to unauthorized data access, modification, or exfiltration. For GDPR, it risks violating principles of data protection and user rights. For HIPAA, it could expose protected health information if exploited on systems handling such data.

Mitigation Strategies

Immediately update iTerm2 to version 3.7.7beta2 or later. Download the latest version from the official iTerm2 website to ensure the vulnerability is patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123014. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...