CVE-2026-45035
HighSummary
Tabby (formerly Terminus) is a highly configurable terminal emulator that prior to version 1.0.233 registered itself as the handler for the tabby:// URL scheme. This handler supports a run command that executes OS commands without user confirmation, allowing an attacker to perform remote code execution.
Risk Assessment
This vulnerability allows attackers to execute arbitrary OS commands with the user's full privileges, posing a significant security risk to the system.
Recommendation
It is recommended to update Tabby to version 1.0.233 or later to mitigate this vulnerability and to restrict the opening of links from untrusted sources.
Other vulnerabilities in Tabby (formerly Terminus)
Original NVD description (English source)
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby registers itself as the handler for the tabby:// URL scheme on all platforms. The URL scheme handler supports a run command that directly executes OS commands with no user confirmation, sanitization, or sandboxing. An attacker can craft a malicious link (tabby://run?command=...) and deliver it via a website, email, chat message, or any other medium. When a victim clicks the link, the OS launches Tabby which immediately spawns the specified command as a child process with the user's full privileges. This is a zero-click-after-link-visit RCE vulnerability. This vulnerability is fixed in 1.0.233.