Iterm2
Security incidents tagged Iterm2. Newest first.
1 Iterm2 incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 0
- Longest quiet run: 1 day (Nov 4–Nov 4)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- Patched
iTerm2 x-man-page: link can run attacker commands on your Mac (CVE-2026-123014)
iTerm2, the popular macOS terminal, has an argument injection bug in its x-man-page: URL handler in versions before 3.7.7beta2. Per the CVE record, percent-encoded NUL characters survive iTerm2s input sanitization and are later turned into whitespace, so a crafted link can inject extra arguments into /usr/bin/man, including -P to pick an attacker-controlled pager command that runs with the users privileges. The victim has to open the crafted URL in iTerm2, for example by clicking it in a browser where iTerm2 handles the x-man-page scheme (a browser or macOS confirmation may appear) or in terminal output. The record notes it exists because of an incomplete fix for CVE-2023-46321. The fix landed in 3.7.7beta2, and stable iTerm2 3.7.7 (built Nov 3 2026) now checks man section and page names against a character allowlist; the release notes credit vin01 for finding it. The CVE record rates it CVSS 4.0 8.7 (high). No exploitation has been reported.
iTerm2 (macOS terminal)Since Nov 5, 2026
