CVE-2026-123014 iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary c
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123014?
CVE-2026-123014 is a high-severity vulnerability in iTerm2, published on 5 Nov 2026.
Official description
iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by inducing the user to open a crafted URL in iTerm2. Percent-encoded NUL characters survive input sanitization and are subsequently converted to whitespace during command-line parsing, allowing injection of additional arguments to /usr/bin/man. An attacker can inject the -P option to select an attacker-controlled pager command. NOTE: this issue exists because of an incomplete fix for CVE-2023-46321.
Weakness: CWE-88
Which versions are affected by CVE-2026-123014?
How do I fix CVE-2026-123014?
No fix has been published for CVE-2026-123014 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123014 being exploited?
There is no known exploitation of CVE-2026-123014 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-9hxf-w2gf-j4wv.