iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by inducing the user to open a crafted URL in iTerm2. Percent-encoded NUL characters survive input sanitization and are subsequently converted to whitespace during command-line parsing, allowing injection of additional arguments to /usr/bin/man. An attacker can inject the -P option to select an attacker-controlled pager command. NOTE: this issue exists because of an incomplete fix for CVE-2023-46321.
A vulnerable version of iTerm2 must be installed and receive the crafted x-man-page: URL. For browser-based delivery, iTerm2 must be selected as the application that handles this URL scheme. The user opens the crafted link, and an additional browser or macOS confirmation to launch iTerm2 may be required depending on the configuration.
The maintainer confirms that the fix first shipped in iTerm2 3.7.7beta2 and will be included in the 3.7.7 stable release. The x-man-page: handler now validates manual-page sections and page names against an allowlist of characters. URLs containing NUL or other disallowed characters are rejected with a warning. Users should upgrade to a release containing this fix.