CVE-2023-46321

2023-10-2200:00:00

mitre

www.cve.org

iterm2

security issue

x-man-page

url paths

shell metacharacters

cve-2023-46321

9.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell metacharacters for a /usr/bin/man command line.

References

gitlab.com/gnachman/iterm2/-/commit/de3d351e1bd3bc1c1a4f85fe976c592e497dd071

iterm2.com/downloads.html