Quick answers
- Is CVE-2026-45037 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45037 being exploited in the wild.
- How severe is CVE-2026-45037?
- High severity, with a CVSS score of 7.1, published 15 May 2026.
- Which products and versions are affected?
- Eugeny Tabby < 1.0.232.
- Is there a fix for CVE-2026-45037?
- A patch was published on 1.0.232. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-45037 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-45037?
- Check whether you run Eugeny Tabby at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability in Tabby's terminal linkifier (specifically in tabby-linkifier/src/handlers.ts) allows for unsafe protocol handler execution. The application passes detected URIs directly to the operating system's protocol handler via openExternal() without validating the protocol scheme against a whitelist. An attacker controlling a malicious SSH or Telnet server can send terminal output containing dangerous URIs (e.g., ms-msdt://, vscode://). If a user clicks the rendered link, it triggers the corresponding OS-level handler. On Windows, this can be chained with known protocol handler vulnerabilities to achieve remote code execution. The issue is fixed in version 1.0.232 by implementing a whitelist of safe protocols (http, https, ftp, mailto).
Affected products
- Eugeny Tabby < 1.0.232
Timeline
- 2026-05-04: advisory: GitHub advisory GHSA-cmpc-v2x9-j9x9 published
- 2026-05-15: disclosed: CVE-2026-45037 published to NVD
- 1.0.232: patched