Executive brief
Tabby is a terminal emulator used by developers and system administrators to connect to remote servers. A security flaw allows a malicious server to send specially crafted text that Tabby turns into a clickable link. If a user clicks one of these links, it can trigger dangerous commands or launch other applications on the user's computer, potentially leading to a full system takeover.
Technical details
A vulnerability in Tabby's terminal linkifier (specifically in tabby-linkifier/src/handlers.ts) allows for unsafe protocol handler execution. The application passes detected URIs directly to the operating system's protocol handler via openExternal() without validating the protocol scheme against a whitelist. An attacker controlling a malicious SSH or Telnet server can send terminal output containing dangerous URIs (e.g., ms-msdt://, vscode://). If a user clicks the rendered link, it triggers the corresponding OS-level handler. On Windows, this can be chained with known protocol handler vulnerabilities to achieve remote code execution. The issue is fixed in version 1.0.232 by implementing a whitelist of safe protocols (http, https, ftp, mailto).
Affected products
- Eugeny Tabby < 1.0.232
Timeline
- 2026-05-04: advisory: GitHub advisory GHSA-cmpc-v2x9-j9x9 published
- 2026-05-15: disclosed: CVE-2026-45037 published to NVD
- 1.0.232: patched