critical9.8
CVE-2023-46321
iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs.
Impact
iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell metacharacters for a /usr/bin/man command line.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Iterm2 | Iterm2 | through 3.4.21 Version 3.5.0 |