Skip to content
CVE PROGRAM SOURCE RECORD8.4 High

CVE-2026-45038

Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution

Description

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, since Tabby does not escape control characters from file paths when dragging and dropping a file into it, code execution can be achieved. This vulnerability is fixed in 1.0.233.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Eugeny tabby

  • < 1.0.233affected

References