Executive brief
Tabby is a terminal emulator used by developers and system administrators to interact with computer systems. A security flaw allows an attacker to execute malicious commands on a user's computer if the user drags and drops a specially named file into the Tabby terminal window. This occurs because the application fails to properly clean file names that contain hidden shell commands, leading to a full system compromise when the user presses Enter.
Technical details
An OS command injection vulnerability exists in Tabby's 'pathDrop.ts' component. When a file is dragged and dropped into a terminal tab, the application inserts the file path into the active shell session. While a previous fix (CVE-2026-45038) removed control characters to prevent automatic execution, it failed to neutralize shell metacharacters such as $(...) and `...`. If a user drops a file with a malicious name and subsequently presses Enter, the shell (POSIX-compliant or PowerShell) evaluates the embedded command substitution. This allows for arbitrary code execution with the privileges of the user running the terminal. The issue is resolved in version 1.0.234 by improving the quoting and escaping of dropped paths.
Affected products
- Eugeny Tabby (formerly Terminus) < 1.0.234
Timeline
- 2026-05-17: patched: Fix committed and version 1.0.234 released.
- 2026-07-15: disclosed: CVE-2026-46709 published.