CVE-2023-46321

Name of the Vulnerable Software and Affected Versions iTerm2 versions prior to 3.5.0beta12

Description The issue is related to the iTermSessionLauncher.m component in iTerm2, which does not properly sanitize paths in x-man-page URLs. This can lead to the inclusion of shell metacharacters in a /usr/bin/man command line.

Recommendations For versions prior to 3.5.0beta12, update to version 3.5.0beta12 or later to resolve the issue. As a temporary workaround, consider restricting the use of x-man-page URLs to minimize the risk of exploitation.