CVE-2026-45038

High

Published: 15/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to version 1.0.233, the lack of escaping control characters from file paths when dragging and dropping a file allowed for code execution.

Risk Assessment

This vulnerability could lead to unauthorized code execution, posing a significant security risk to the system.

Recommendation

It is recommended to upgrade to version 1.0.233 or later to mitigate this vulnerability.

Other vulnerabilities in Tabby (formerly Terminus)

CVE-2026-45035High
Tabby (formerly Terminus) is a highly configurable terminal emulator that prior to version 1.0.233 registered itself as the handler for the tabby:// URL scheme. This handler supports a run command that executes OS commands without user confirmation, allowing an attacker to perform remote code execution.

Original NVD description (English source)

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, since Tabby does not escape control characters from file paths when dragging and dropping a file into it, code execution can be achieved. This vulnerability is fixed in 1.0.233.