Skip to content
Threat Feed
Subscribe
high advisory

iTerm2: NUL-byte argument injection in x-man-page URI handler (CVE-2026-123014)

A public proof-of-concept exploit for CVE-2026-123014 targets a NUL-byte argument injection vulnerability in the iTerm2 x-man-page URI handler, enabling arbitrary command execution via maliciously crafted links.

CVE search metadata

CVE search record: CVE-2026-123014. KEV: no. Product: iTerm2. Brief: iTerm2: NUL-byte argument injection in x-man-page URI handler (CVE-2026-123014). Brief link: https://feed.craftedsignal.io/briefs/2026-11-iterm2-nul-byte-injection/

Triage facts

Revision 1
Applicability
iTerm2
Evidence
Unknown
Severity
High
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Nov 7, 02:04 UTC
Vulnerabilities
1 CVE
Source quality
C2Likely

CVE-2026-123014 is a NUL-byte argument injection vulnerability in the iTerm2 terminal emulator. The flaw exists within the handling of the x-man-page URI scheme. An attacker can trigger arbitrary command execution if a user interacts with a specially crafted URI. A proof-of-concept exploit script written in Shell has been publicly released, increasing the risk of exploitation.

Impact

The vulnerability allows for remote command execution with the privileges of the iTerm2 application. According to CVSS 4.0 assessment, this vulnerability carries a high severity (8.7) with potential for high impact on system confidentiality and integrity.

Recommendation

  • Inventory systems running iTerm2 to identify potentially vulnerable versions.
  • Monitor for official security updates from the iTerm2 project and apply patches immediately upon release.
  • Advise users to avoid opening untrusted or unexpected x-man-page:// URI links in browsers or applications.

Immediate actions

Identify all macOS endpoints with iTerm2 installed via EDR inventory.

SOC 24h

Threat Hunt

Hunt for iTerm2 processes spawned by browser processes or system URI handlers (e.g., launchd) with command line arguments containing x-man-page protocols.

T1203 high medium confidence hunt now

Data: EDR process creation logs (ParentProcessName, CommandLine)

Mitigations

Disable x-man-page URI scheme association if possible or restrict its use via organization policy.

immediate IT Operations

CVE-2026-123014

Gaps

  • Missing confirmed list of affected version ranges.