iTerm2 x-man-page: link can run attacker commands on your Mac (CVE-2026-123014) ยท updates https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014 iTerm2, the popular macOS terminal, has an argument injection bug in its x-man-page: URL handler in versions before 3.7.7beta2. Per the CVE record, percent-encoded NUL characters survive iTerm2s input sanitization and are later turned into whitespace, so a crafted link can inject extra arguments into /usr/bin/man, including -P to pick an attacker-controlled pager command that runs with the users privileges. The victim has to open the crafted URL in iTerm2, for example by clicking it in a browser where iTerm2 handles the x-man-page scheme (a browser or macOS confirmation may appear) or in terminal output. The record notes it exists because of an incomplete fix for CVE-2023-46321. The fix landed in 3.7.7beta2, and stable iTerm2 3.7.7 (built Nov 3 2026) now checks man section and page names against a character allowlist; the release notes credit vin01 for finding it. The CVE record rates it CVSS 4.0 8.7 (high). No exploitation has been reported. en Thu, 05 Nov 2026 00:00:00 GMT iTerm2 x-man-page: link can run attacker commands on your Mac (CVE-2026-123014): CVE-2026-123014 is published: percent-encoded NUL characters let a crafted x-man-page: URL inject arguments such as -P into /usr/bin/man and run arbitrary commands, an incomplete fix for CVE-2023-46321; CVSS 4.0 8.7. https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014 https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014#2026-11-05-3b7f6fad Thu, 05 Nov 2026 00:00:00 GMT high <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-123014">Source</a></p> iTerm2 x-man-page: link can run attacker commands on your Mac (CVE-2026-123014): iTerm2 3.7.7 ships with a hardened x-man-page: handler: man section and page names are checked against an allowlist and URLs with disallowed characters are rejected; the release notes credit vin01 for finding the bug. https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014 https://pwn.watch/i/iterm2-x-man-page-argument-injection-cve-2026-123014#2026-11-03-885028d6 Tue, 03 Nov 2026 00:00:00 GMT high <p><a href="https://iterm2.com/appcasts/full_changes.txt">Source</a></p>