CVE-2026-45036
HighSummary
Tabby (formerly Terminus) prior to version 1.0.233 automatically confirms ZMODEM protocol detection on terminal session output without user interaction, enabling shell command execution when a user displays attacker-controlled content.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious code on the victim's system, posing a significant security risk to the organization.
Recommendation
It is recommended to update Tabby to version 1.0.233 or later to mitigate this vulnerability and to restrict terminal session output to trusted sources.
Other vulnerabilities in Tabby terminal emulator
Original NVD description (English source)
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby before 1.0.233 automatically confirms ZMODEM protocol detection on all terminal session output without user interaction, enabling shell command execution when a user displays attacker-controlled content. The ZModemMiddleware in tabby-terminal consumes all session output through a Zmodem.Sentry, and when a ZMODEM ZRQINIT header is detected, unconditionally calls detection.confirm() and writes a fixed ZRINIT response ( **\x18B0100000023be50\r\n\x11) back into the active PTY as input. When the process that triggered the detection (e.g., cat) exits, the injected bytes are consumed by the user's shell as a command line. Under fish (default configuration), the ** prefix triggers recursive glob expansion against the current directory, allowing an attacker-placed executable at a matching nested path (e.g., d/xB0100000023be50) to be executed by relative pathname without relying on PATH. Under bash and