CVE-2026-45035 Details
Description
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby registers itself as the handler for the tabby:// URL scheme on all platforms. The URL scheme handler supports a run command that directly executes OS commands with no user confirmation, sanitization, or sandboxing. An attacker can craft a malicious link (tabby://run?command=...) and deliver it via a website, email, chat message, or any other medium. When a victim clicks the link, the OS launches Tabby which immediately spawns the specified command as a child process with the user's full privileges. This is a zero-click-after-link-visit RCE vulnerability. This vulnerability is fixed in 1.0.233.
A remote code execution vulnerability exists in Tabby (formerly Terminus) versions prior to 1.0.233. The application registers as the handler for the 'tabby://' URL scheme on all platforms. This handler supports a 'run' command that executes operating system commands without user confirmation, sanitization, or sandboxing. An attacker can create a malicious link and deliver it through various channels. When the link is clicked, Tabby is launched, and the specified command is executed as a child process with the user's full privileges, creating a zero-click-after-link-visit remote code execution vulnerability.
Users can update to Tabby version 1.0.233 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Eugeny/tabby/security/advisories/GHSA-hf8h-rjrf-3jg6 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/Eugeny/tabby/security/advisories/GHSA-hf8h-rjrf-3jg6 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tabby tabby | < 1.0.233 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | Initial Analysis | [email protected] |
| May 15, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | New CVE Received | [email protected] |