CVE-2026-46709

HighCVSS 7.8

Published: 15/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 17/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

A vulnerability in Tabby (formerly Terminus) prior to version 1.0.234 allows code execution via command injection when dropping files. The lack of neutralization of command substitution metacharacters ($(...) and `...`) enables an attacker to execute arbitrary code after the victim presses Enter.

Risk Assessment

The risk for the organization is remote code execution by an attacker, potentially compromising administrator or developer workstations, leading to data theft, malware installation, or privilege escalation.

Recommendation

Immediately update Tabby to version 1.0.234 or later. In the meantime, avoid dropping files from untrusted sources into the terminal.

Other vulnerabilities in Tabby

CVE-2026-72903High
Tabby (formerly Terminus) before version 1.0.235 contains a path traversal vulnerability via a malicious SFTP server. The server can return filenames with backslashes, which are interpreted as path separators on Windows, allowing files to be created or overwritten outside the selected directory.

Original NVD description (English source)

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and `…`, so the incomplete CVE-2026-45038 fix for control characters still allows code execution when the victim presses Enter. This issue is fixed in version 1.0.234.