CVE-2026-123014 in iTerm2: Argument Injection via URL

CVE-2026-123014 is an argument injection vulnerability in the x-man-page: URL handler of iTerm2, the widely-used terminal for macOS. An attacker can trick a user into opening a crafted URL, exploiting a sanitization bypass: percent-encoded NUL characters survive validation and become whitespace. This allows injection of extra arguments to the /usr/bin/man command, specifically the -P option for an attacker-controlled pager, enabling command execution with user privileges.

The vulnerability is rated CVSS 8.7 (high severity). It was reported to NVD on November 5, 2026. As of November 7, public PoCs appear on GitHub repositories: a clear signal that technical details are already accessible and active exploitation risk is concrete. This is a reopening of CVE-2023-46321, an earlier flaw incompletely patched. There are no reports yet of active exploitation in the wild, but the combination of public PoC, absence of stable patches, and prevalence of the affected product creates a significant vulnerability window.

For defenders: 1) Update iTerm2 to stable 3.7.7 as soon as available; use 3.7.7beta2 in the interim; 2) restrict clicking x-man-page: URLs if workflow permits; 3) educate users to avoid suspicious URLs from untrusted sources; 4) monitor system logs for anomalous man executions with unusual -P options. For CISOs: quantify iTerm2 adoption in development and IT teams, and coordinate urgent patching given CVSS 8.7 severity and public PoC availability.