Threats tagged 'ghsa-9hxf-w2gf-j4wv'

iTerm2 versions before 3.7.7beta2 contain an argument injection vulnerability in the x-man-page URL handler. This flaw allows an attacker to execute arbitrary commands with the privileges of the logged-in user by tricking the user into opening a specially crafted URL. The vulnerability arises because percent-encoded NUL characters bypass input sanitization and are converted to whitespace during command-line parsing, enabling injection of additional arguments to the /usr/bin/man command, including the -P option to specify a malicious pager command. This issue is a regression due to an incomplete fix for CVE-2023-46321.