Quick answers
- Is CVE-2026-45035 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45035 being exploited in the wild.
- How severe is CVE-2026-45035?
- Informational severity, with a CVSS score of 9.4, published 15 May 2026.
- Which products and versions are affected?
- Eugeny Tabby < 1.0.233.
- Is there a fix for CVE-2026-45035?
- A patch was published on 2026-05-15: Vulnerability fixed in version 1.0.233 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-45035 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-45035?
- Check whether you run Eugeny Tabby at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Tabby (formerly Terminus) prior to version 1.0.233 registers a custom URL scheme handler (tabby://) that is vulnerable to OS command injection. The handler supports a 'run' command that parses arguments using the shell-quote library but fails to implement any sanitization, sandboxing, or user confirmation prompts before execution. An attacker can deliver a malicious URI (e.g., tabby://run?command=...) via a web browser or other application. When the link is clicked, the OS passes the URI to Tabby, which spawns the specified command as a child process using the user's full privileges. This results in remote code execution (RCE) with minimal user interaction (one click to follow the link). The issue was fixed in version 1.0.233 by restricting the URL handler's capabilities.
Affected products
- Eugeny Tabby < 1.0.233
Timeline
- 2026-05-07: advisory: Vendor advisory published on GitHub
- 2026-05-15: disclosed: CVE-2026-45035 published to NVD
- 2026-05-15: patched: Vulnerability fixed in version 1.0.233