Tabby vulnerabilities

Tabby (formerly Terminus) before version 1.0.235 contains a path traversal vulnerability via a malicious SFTP server. The server can return filenames with backslashes, which are interpreted as path separators on Windows, allowing files to be created or overwritten outside the selected directory.

A vulnerability in Tabby (formerly Terminus) prior to version 1.0.234 allows code execution via command injection when dropping files. The lack of neutralization of command substitution metacharacters ($(...) and `...`) enables an attacker to execute arbitrary code after the victim presses Enter.

In Tabby prior to 1.0.233, the application automatically confirms ZMODEM protocol detection on terminal session output and injects a fixed ZRINIT response into the PTY. When a user displays a malicious file (e.g., via `cat`), the injected bytes are interpreted by the shell as a command, leading to code execution without user interaction.