CVE-2026-46709
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability in Tabby (formerly Terminus) prior to version 1.0.234 allows code execution via command injection when dropping files. The lack of neutralization of command substitution metacharacters ($(...) and `...`) enables an attacker to execute arbitrary code after the victim presses Enter.
Risk Assessment
The risk for the organization is remote code execution by an attacker, potentially compromising administrator or developer workstations, leading to data theft, malware installation, or privilege escalation.
Recommendation
Immediately update Tabby to version 1.0.234 or later. In the meantime, avoid dropping files from untrusted sources into the terminal.
Other vulnerabilities in Tabby
See all- CVE-2026-72903High
Tabby (formerly Terminus) before version 1.0.235 contains a path traversal vulnerability via a malicious SFTP server. The server can return filenames with backslashes, which are interpreted as path separators on Windows, allowing files to be created or overwritten outside the selected directory.
- CVE-2026-45036High
In Tabby prior to 1.0.233, the application automatically confirms ZMODEM protocol detection on terminal session output and injects a fixed ZRINIT response into the PTY. When a user displays a malicious file (e.g., via `cat`), the injected bytes are interpreted by the shell as a command, leading to code execution without user interaction.
Original NVD description (English source)
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and `…`, so the incomplete CVE-2026-45038 fix for control characters still allows code execution when the victim presses Enter. This issue is fixed in version 1.0.234.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS