# CVE-2026-45037: Eugeny Tabby unsafe protocol handler execution in terminal linkifier

Source: https://junglewise.ai/threats/cve-2026-45037-eugeny-tabby-unsafe-protocol-handler-execution-in-terminal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-45037 · Severity: high · CVSS 7.1 · Published 2026-05-15

Tabby is a terminal emulator used by developers and system administrators to connect to remote servers. A security flaw allows a malicious server to send specially crafted text that Tabby turns into a clickable link. If a user clicks one of these links, it can trigger dangerous commands or launch other applications on the user's computer, potentially leading to a full system takeover.

Technologies: [Eugeny Tabby](https://junglewise.ai/threats/technologies/tabby). Vendors: [Eugeny](https://junglewise.ai/threats/vendors/eugeny).

## Quick answers

**Is CVE-2026-45037 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45037 being exploited in the wild.

**How severe is CVE-2026-45037?** High severity, with a CVSS score of 7.1, published 15 May 2026.

**Which products and versions are affected?** Eugeny Tabby < 1.0.232.

**Is there a fix for CVE-2026-45037?** A patch was published on 1.0.232. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45037 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45037?** Check whether you run Eugeny Tabby at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in Tabby's terminal linkifier (specifically in tabby-linkifier/src/handlers.ts) allows for unsafe protocol handler execution. The application passes detected URIs directly to the operating system's protocol handler via openExternal() without validating the protocol scheme against a whitelist. An attacker controlling a malicious SSH or Telnet server can send terminal output containing dangerous URIs (e.g., ms-msdt://, vscode://). If a user clicks the rendered link, it triggers the corresponding OS-level handler. On Windows, this can be chained with known protocol handler vulnerabilities to achieve remote code execution. The issue is fixed in version 1.0.232 by implementing a whitelist of safe protocols (http, https, ftp, mailto).

## Affected products

- Eugeny Tabby < 1.0.232

## Timeline

- 2026-05-04: advisory: GitHub advisory GHSA-cmpc-v2x9-j9x9 published
- 2026-05-15: disclosed: CVE-2026-45037 published to NVD
- 1.0.232: patched

## References

- [https://github.com/Eugeny/tabby/security/advisories/GHSA-cmpc-v2x9-j9x9](https://github.com/Eugeny/tabby/security/advisories/GHSA-cmpc-v2x9-j9x9)

## Related threats

- [Eugeny Russh channel-scoped callback bypass for unopened channels](https://junglewise.ai/threats/cve-2026-68930-eugeny-russh-channel-scoped-callback-bypass-for-unopened-channels)
- [Eugeny Tabby OS command injection via drag-and-drop file path](https://junglewise.ai/threats/cve-2026-46709-eugeny-tabby-os-command-injection-via-drag-and-drop-file-path)
- [Eugeny Russh resource exhaustion in SSH identification parsing](https://junglewise.ai/threats/cve-2026-48108-eugeny-russh-resource-exhaustion-in-ssh-identification-parsing)
- [Eugeny Russh authentication state mismatch in SSH server](https://junglewise.ai/threats/cve-2026-46705-eugeny-russh-authentication-state-mismatch-in-ssh-server)
- [Eugeny Tabby code execution via drag-and-drop control characters](https://junglewise.ai/threats/cve-2026-45038-eugeny-tabby-code-execution-via-drag-and-drop-control-characters)