{"affected":[{"defaultStatus":"unknown","platforms":["MacOS"],"product":"iTerm2","source":"CNA: mitre","vendor":"iTerm2","versions":[{"lessThan":"3.7.7beta2","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-123014","cwes":["CWE-88"],"description":"iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by inducing the user to open a crafted URL in iTerm2. Percent-encoded NUL characters survive input sanitization and are subsequently converted to whitespace during command-line parsing, allowing injection of additional arguments to /usr/bin/man. An attacker can inject the -P option to select an attacker-controlled pager command. NOTE: this issue exists because of an incomplete fix for CVE-2023-46321.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: mitre","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793856355141,"publishedAt":1793856355141,"references":[{"source":"CNA: mitre","tags":["patch"],"url":"https://gitlab.com/gnachman/iterm2/-/commit/f29420ae4d3e0f986ee24ea286885d32af58175a"},{"source":"CNA: mitre","tags":["release-notes"],"url":"https://iterm2.com/downloads.html"},{"source":"CNA: mitre","tags":["patch"],"url":"https://gitlab.com/gnachman/iterm2/-/commit/314ba43920dbce08808c032e89966918090bdf8e"}],"remediation":[{"kind":"fix","source":"CNA: mitre","text":"The maintainer confirms that the fix first shipped in iTerm2 3.7.7beta2 and will be included in the 3.7.7 stable release. The x-man-page: handler now validates manual-page sections and page names against an allowlist of characters. URLs containing NUL or other disallowed characters are rejected with a warning. Users should upgrade to a release containing this fix."},{"kind":"fix","source":"CNA: mitre","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://gitlab.com/gnachman/iterm2/-/commit/f29420ae4d3e0f986ee24ea286885d32af58175a"},{"kind":"fix","source":"CNA: mitre","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://gitlab.com/gnachman/iterm2/-/commit/314ba43920dbce08808c032e89966918090bdf8e"}],"revision":"54f72490531f2669a363812478af3f938b879f8cbf252525afd5538264c217ab","sources":[{"modifiedAt":1793856355141,"name":"CNA: mitre","retrievedAt":1793858990288,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123014"}],"ssvc":null,"status":"published","title":"CVE-2026-123014","updatedAt":1793858990288}