CVE-2026-45037

High

Published: 15/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to version 1.0.232, Tabby's terminal linkifier passed detected URIs directly to the operating system's protocol handler without validating the protocol scheme, allowing malicious SSH or Telnet servers to send crafted terminal output containing dangerous URIs.

Risk Assessment

The risk is that malicious URIs could trigger unauthorized OS protocol handlers on the victim's machine, leading to potential attacks and system compromise.

Recommendation

It is recommended to update Tabby to version 1.0.232 or later to mitigate this vulnerability and to implement additional security measures to monitor and restrict access to unknown servers.

Other vulnerabilities in Tabby terminal emulator

CVE-2026-45036High
Tabby (formerly Terminus) prior to version 1.0.233 automatically confirms ZMODEM protocol detection on terminal session output without user interaction, enabling shell command execution when a user displays attacker-controlled content.

Original NVD description (English source)

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's terminal linkifier passes any detected URI directly to the operating system's protocol handler without validating the protocol scheme. This allows a malicious SSH or Telnet server to send crafted terminal output containing dangerous protocol URIs which Tabby renders as clickable links, triggering arbitrary OS protocol handlers on the victim's machine. This vulnerability is fixed in 1.0.232.