Executive brief
Tabby (formerly Terminus) is a terminal emulator used by developers and system administrators to manage command-line interfaces. A vulnerability in how the application handles custom web links allows an attacker to execute arbitrary commands on a victim's computer. If a user clicks a specially crafted link (delivered via email, chat, or a website), the application will immediately run the attacker's commands with the user's full system privileges without any further confirmation.
Technical details
Tabby (formerly Terminus) prior to version 1.0.233 registers a custom URL scheme handler (tabby://) that is vulnerable to OS command injection. The handler supports a 'run' command that parses arguments using the shell-quote library but fails to implement any sanitization, sandboxing, or user confirmation prompts before execution. An attacker can deliver a malicious URI (e.g., tabby://run?command=...) via a web browser or other application. When the link is clicked, the OS passes the URI to Tabby, which spawns the specified command as a child process using the user's full privileges. This results in remote code execution (RCE) with minimal user interaction (one click to follow the link). The issue was fixed in version 1.0.233 by restricting the URL handler's capabilities.
Affected products
- Eugeny Tabby < 1.0.233
Timeline
- 2026-05-07: advisory: Vendor advisory published on GitHub
- 2026-05-15: disclosed: CVE-2026-45035 published to NVD
- 2026-05-15: patched: Vulnerability fixed in version 1.0.233