Cpe:2.3:a:iterm2:iterm2:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aiterm2iterm2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 07 Nov 2026 02:04:29 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgiTerm2: NUL-byte argument injection in x-man-page URI handler (CVE-2026-123014)https://feed.craftedsignal.io/briefs/2026-11-iterm2-nul-byte-injection/Sat, 07 Nov 2026 02:04:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-iterm2-nul-byte-injection/A public proof-of-concept exploit for CVE-2026-123014 targets a NUL-byte argument injection vulnerability in the iTerm2 x-man-page URI handler, enabling arbitrary command execution via maliciously crafted links.CVE-2026-123014 is a NUL-byte argument injection vulnerability in the iTerm2 terminal emulator. The flaw exists within the handling of the x-man-page URI scheme. An attacker can trigger arbitrary command execution if a user interacts with a specially crafted URI. A proof-of-concept exploit script written in Shell has been publicly released, increasing the risk of exploitation.

Impact

The vulnerability allows for remote command execution with the privileges of the iTerm2 application. According to CVSS 4.0 assessment, this vulnerability carries a high severity (8.7) with potential for high impact on system confidentiality and integrity.

Recommendation

  • Inventory systems running iTerm2 to identify potentially vulnerable versions.
  • Monitor for official security updates from the iTerm2 project and apply patches immediately upon release.
  • Advise users to avoid opening untrusted or unexpected x-man-page:// URI links in browsers or applications.
]]>highadvisory