CVE-2026-123014

    Dashboard / Vulnerabilities / CVE-2026-123014

    CVE-2026-123014

    Published: 5 Nov 2026Last Modified: 6 Nov 2026

    Summary:

    Details: iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by inducing the user to open a crafted URL in iTerm2. Percent-encoded NUL characters survive input sanitization and are subsequently converted to whitespace during command-line parsing, allowing injection of additional arguments to /usr/bin/man. An attacker can inject the -P option to select an attacker-controlled pager command. NOTE: this issue exists because of an incomplete fix for CVE-2023-46321.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123014.json, https://iterm2.com/downloads.html, https://nvd.nist.gov/vuln/detail/CVE-2026-123014, https://gitlab.com/gnachman/iterm2/-/commit/314ba43920dbce08808c032e89966918090bdf8e, https://gitlab.com/gnachman/iterm2/-/commit/f29420ae4d3e0f986ee24ea286885d32af58175a, https://gitlab.com/gnachman/iterm2

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 833c26999072e97d2468cfa88fc274157e879aee
    Fixed -8ea34d10285ac9af43bd550a901500b983f5063a

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-123014 | CVE-DB