Argument Injection Vulnerability in iTerm2 by Gernot Nachman

CVE-2026-123014

What is CVE-2026-123014?

The vulnerability in iTerm2 affects versions prior to 3.7.7beta2 and is characterized by an argument injection flaw in the x-man-page URL handler. An attacker can exploit this vulnerability by convincing a user to open a specially crafted URL, which allows the execution of arbitrary commands using the privileges of the logged-in user. The issue is exacerbated by the existence of percent-encoded NUL characters that bypass input sanitization and are later converted to whitespace during command-line parsing. This manipulation enables the injection of additional arguments into the /usr/bin/man command, potentially allowing the attacker to specify an unauthorized pager command. This vulnerability arose due to an incomplete fix for a previous issue.

References