Is CVE-2026-46709 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46709 being exploited in the wild.

How severe is CVE-2026-46709?

High severity, with a CVSS score of 7.8, published 15 July 2026.

Is there a fix for CVE-2026-46709?

A patch was published on 2026-05-17: Fix committed and version 1.0.234 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46709 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-46709?

Check whether you run Eugeny Tabby at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46709: Eugeny Tabby OS command injection via drag-and-drop file path

CVE-2026-46709 · Severity: high · CVSS 7.8 · Published 2026-07-15

Tabby is a terminal emulator used by developers and system administrators to interact with computer systems. A security flaw allows an attacker to execute malicious commands on a user's computer if the user drags and drops a specially named file into the Tabby terminal window. This occurs because the application fails to properly clean file names that contain hidden shell commands, leading to a full system compromise when the user presses Enter.

Technologies: Eugeny Tabby. Vendors: Eugeny.

Quick answers

Is CVE-2026-46709 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46709 being exploited in the wild.
How severe is CVE-2026-46709?: High severity, with a CVSS score of 7.8, published 15 July 2026.
Which products and versions are affected?: Eugeny Tabby < 1.0.234.
Is there a fix for CVE-2026-46709?: A patch was published on 2026-05-17: Fix committed and version 1.0.234 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46709 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-46709?: Check whether you run Eugeny Tabby at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in Tabby's 'pathDrop.ts' component. When a file is dragged and dropped into a terminal tab, the application inserts the file path into the active shell session. While a previous fix (CVE-2026-45038) removed control characters to prevent automatic execution, it failed to neutralize shell metacharacters such as $(...) and `...`. If a user drops a file with a malicious name and subsequently presses Enter, the shell (POSIX-compliant or PowerShell) evaluates the embedded command substitution. This allows for arbitrary code execution with the privileges of the user running the terminal. The issue is resolved in version 1.0.234 by improving the quoting and escaping of dropped paths.

Affected products

Eugeny Tabby (formerly Terminus) < 1.0.234

Timeline

2026-05-17: patched: Fix committed and version 1.0.234 released.
2026-07-15: disclosed: CVE-2026-46709 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.