iTerm2 x-man-page URL handler flaw allows arbitrary command execution
One malicious link can let attackers hack a Mac user's computer.
Summary
An argument injection flaw in iTerm2's x-man-page: URL handler lets an attacker run arbitrary commands with the privileges of a user who opens a crafted link. macOS users of iTerm2 are affected.
Affected when
- User opens a crafted x-man-page: URL in iTerm2
What to do
Update iTerm2 to 3.7.7 or later.
Products and platforms
CVE IDs
Sources
- Advisory: iterm2.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen