iTerm2 x-man-page: link can run attacker commands on your Mac (CVE-2026-123014)
iTerm2 (macOS terminal)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
iTerm2, the popular macOS terminal, has an argument injection bug in its x-man-page: URL handler in versions before 3.7.7beta2. Per the CVE record, percent-encoded NUL characters survive iTerm2s input sanitization and are later turned into whitespace, so a crafted link can inject extra arguments into /usr/bin/man, including -P to pick an attacker-controlled pager command that runs with the users privileges. The victim has to open the crafted URL in iTerm2, for example by clicking it in a browser where iTerm2 handles the x-man-page scheme (a browser or macOS confirmation may appear) or in terminal output. The record notes it exists because of an incomplete fix for CVE-2023-46321. The fix landed in 3.7.7beta2, and stable iTerm2 3.7.7 (built Nov 3 2026) now checks man section and page names against a character allowlist; the release notes credit vin01 for finding it. The CVE record rates it CVSS 4.0 8.7 (high). No exploitation has been reported.
Why this severity: Command execution as the user after opening a crafted link; CVSS 4.0 8.7 (high) per the CVE record; needs user interaction; no exploitation reported
- Started
- Nov 5, 2026
Affected
- iTerm2 before 3.7.7beta2
Fixed in
- iTerm2 3.7.7beta2
- iTerm2 3.7.7
Timeline2
CVE-2026-123014 is published: percent-encoded NUL characters let a crafted x-man-page: URL inject arguments such as -P into /usr/bin/man and run arbitrary commands, an incomplete fix for CVE-2023-46321; CVSS 4.0 8.7.
iTerm2 3.7.7 ships with a hardened x-man-page: handler: man section and page names are checked against an allowlist and URLs with disallowed characters are rejected; the release notes credit vin01 for finding the bug.
Advisories3
Get an email when a new major security incident drops. No spam, unsubscribe any time.
