Read the docs
TI-2026-85347 Aliases CVE-2026-123014GHSA-9hxf-w2gf-j4wv

Argument injection in iTerm2 x-man-page URL handler lets attackers run commands

Priority LOW 38CWE-88Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-88.

Summary

iTerm2 before 3.7.7beta2 has an argument injection flaw in its x-man-page: URL handler (CWE-88). Percent-encoded NUL characters pass input sanitization and turn into whitespace during command-line parsing, which lets an attacker add arguments to /usr/bin/man, including the -P option to select a pager command. An unauthenticated remote attacker can run arbitrary commands with the privileges of the logged-in user if the user opens a crafted URL in iTerm2. The issue exists because of an incomplete fix for CVE-2023-46321.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by inducing the user to open a crafted URL in iTerm2. Percent-encoded NUL characters survive input sanitization and are subsequently converted to whitespace during command-line parsing, allowing injection of additional arguments to /usr/bin/man. An attacker can inject the -P option to select an attacker-controlled pager command. NOTE: this issue exists because of an incomplete fix for CVE-2023-46321.

Why it matters now

EPSS 0.00475 41st percentileScored 2026-11-07
Fix Fixed iTerm2 (iTerm2): 3.7.7beta2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
iTerm2iTerm2before 3.7.7beta23.7.7beta2Patch availableCNA
  • iTerm2 VendoriTerm2 Affected before 3.7.7beta2 Fixed in 3.7.7beta2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:iterm2:iterm2:*:*:*:*:*:*:*:*——iTerm2
  • cpe:2.3:a:iterm2:iterm2:*:*:*:*:*:*:*:* Versions — — ·iTerm2

Remediation

Update iTerm2 to version 3.7.7beta2 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA iTerm2 (iTerm2) Fixed in 3.7.7beta2

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-123014
  2. 2026-11-05 Alias added: GHSA-9hxf-w2gf-j4wv
  3. 2026-11-06 Priority changed: MEDIUM → LOW

References

Patch 2

Other 1

  • TI-2024-25648 An issue was discovered in iTerm2 3.5.x before 3.5.2. CVSS 3.1CRITICAL 9.8
  • TI-2023-24916 iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of… CVSS 3.1CRITICAL 9.8
  • TI-2023-24915 iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of… CVSS 3.1CRITICAL 9.8
  • TI-2026-29861 In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p… CVSS 3.1HIGH 7.8
  • TI-2024-25647 In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored… CVSS 3.1CRITICAL 9.8
  • TI-2022-22670 iTerm2 before 3.4.18 mishandles a DECRQSS response. CVSS 3.1CRITICAL 9.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences