{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "iTerm2 x-man-page: link can run attacker commands on your Mac (CVE-2026-123014) · updates",
  "home_page_url": "https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014",
  "feed_url": "https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014/feed.json",
  "description": "iTerm2, the popular macOS terminal, has an argument injection bug in its x-man-page: URL handler in versions before 3.7.7beta2. Per the CVE record, percent-encoded NUL characters survive iTerm2s input sanitization and are later turned into whitespace, so a crafted link can inject extra arguments into /usr/bin/man, including -P to pick an attacker-controlled pager command that runs with the users privileges. The victim has to open the crafted URL in iTerm2, for example by clicking it in a browser where iTerm2 handles the x-man-page scheme (a browser or macOS confirmation may appear) or in terminal output. The record notes it exists because of an incomplete fix for CVE-2023-46321. The fix landed in 3.7.7beta2, and stable iTerm2 3.7.7 (built Nov 3 2026) now checks man section and page names against a character allowlist; the release notes credit vin01 for finding it. The CVE record rates it CVSS 4.0 8.7 (high). No exploitation has been reported.",
  "language": "en",
  "_pwn": {
    "slug": "iterm2-x-man-page-argument-injection-cve-2026-123014",
    "severity": "high",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014/feed.xml",
    "llms": "https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014/llms.txt",
    "json": "https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014#2026-11-05-3b7f6fad",
      "url": "https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014#2026-11-05-3b7f6fad",
      "title": "iTerm2 x-man-page: link can run attacker commands on your Mac (CVE-2026-123014): CVE-2026-123014 is published: percent-encoded NUL characters let a crafted x-man-page: URL inject arguments such as -P into /usr/bin/man and run arbitrary commands, an incomplete fix for CVE-2023-46321; CVSS 4.0 8.7.",
      "content_text": "iTerm2 x-man-page: link can run attacker commands on your Mac (CVE-2026-123014): CVE-2026-123014 is published: percent-encoded NUL characters let a crafted x-man-page: URL inject arguments such as -P into /usr/bin/man and run arbitrary commands, an incomplete fix for CVE-2023-46321; CVSS 4.0 8.7.\n\nSource: https://www.cve.org/CVERecord?id=CVE-2026-123014",
      "date_published": "2026-11-05T00:00:00.000Z",
      "external_url": "https://www.cve.org/CVERecord?id=CVE-2026-123014",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014#2026-11-03-885028d6",
      "url": "https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014#2026-11-03-885028d6",
      "title": "iTerm2 x-man-page: link can run attacker commands on your Mac (CVE-2026-123014): iTerm2 3.7.7 ships with a hardened x-man-page: handler: man section and page names are checked against an allowlist and URLs with disallowed characters are rejected; the release notes credit vin01 for finding the bug.",
      "content_text": "iTerm2 x-man-page: link can run attacker commands on your Mac (CVE-2026-123014): iTerm2 3.7.7 ships with a hardened x-man-page: handler: man section and page names are checked against an allowlist and URLs with disallowed characters are rejected; the release notes credit vin01 for finding the bug.\n\nSource: https://iterm2.com/appcasts/full_changes.txt",
      "date_published": "2026-11-03T00:00:00.000Z",
      "external_url": "https://iterm2.com/appcasts/full_changes.txt",
      "tags": [
        "high"
      ]
    }
  ]
}