Executive brief
Tabby is a terminal emulator used by developers and system administrators to interact with computer systems. A security flaw allows an attacker to execute malicious commands on a user's computer if the user drags and drops a specially crafted file into the terminal window. This could lead to a full system compromise, data theft, or unauthorized operations, though it requires the user to perform the manual action of dragging a file with a deceptive name.
Technical details
A vulnerability in Tabby terminal emulator versions prior to 1.0.233 stems from improper neutralization of escape, meta, or control sequences (CWE-150) during drag-and-drop operations. When a file is dropped into the terminal, Tabby fails to escape control characters within the file path. An attacker can craft a filename containing control sequences such as 'End of Text' (\x03) to terminate a running process and 'Carriage Return' (\x0d) to execute a new command. While the attack requires local user interaction, malicious filenames can be padded with junk text to hide the payload from the user's file manager view. The issue is resolved in version 1.0.233 by properly escaping control characters in file paths.
Affected products
- Eugeny Tabby < 1.0.233
Timeline
- 2026-05-07: advisory: Vendor advisory published on GitHub
- 2026-05-15: disclosed: CVE published to NVD