---
id: "CVE-2026-123014"
kind: "vulnerability"
aliases: ["CVE-2026-123014"]
title: "iTerm2: crafted x-man-page URL runs commands as the logged-in user"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["developer-workstations", "iterm2", "macos", "other"]
not_affected_if: ["iterm2-3.7.7beta2-or-later", "no-iterm2-installed"]
published_at: "2026-11-05T06:17:07+00:00"
first_seen_at: "2026-11-05T06:31:51+00:00"
updated_at: "2026-11-05T06:32:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123014", "first_seen_at": "2026-11-05T06:31:51+00:00"}]
exploit_sources: []
---

# iTerm2: crafted x-man-page URL runs commands as the logged-in user

iTerm2 before 3.7.7beta2 mishandles the x-man-page: URL handler, so percent-encoded NUL characters survive sanitization and become whitespace, letting an attacker inject extra arguments into /usr/bin/man. Injecting the -P option selects an attacker-controlled pager command, which runs with the privileges of the logged-in user once the victim opens the crafted URL.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed iTerm2 version in the About iTerm2 window or with `defaults read com.googlecode.iterm2 Version` (exact key unknown from sources)
- Confirm whether the installed version is before `3.7.7beta2`

## Fix

- iTerm2 `3.7.7beta2` (fixed version stated by the product range; earlier versions affected)

## Timeline

- 2026-11-05T06:31:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123014

## From the sources

iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by inducing the user to open a crafted URL in iTerm2. Percent-encoded NUL characters survive input sanitization and are subsequently converted to whitespace during command-line parsing, allowing injection of additional arguments to /usr/bin/man. An attacker can inject the -P option to select an attacker-controlled pager command. NOTE: this issue exists because of an incomplete fix for CVE-2023-46321.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_