Code Execution Vulnerability in Tabby Terminal Emulator
CVE-2026-45038

8.4HIGH

Key Information:

Vendor

Eugeny

Status
Tabby
Vendor
CVE Published:
15 May 2026

What is CVE-2026-45038?

The Tabby terminal emulator, previously known as Terminus, is susceptible to a code execution vulnerability due to improper handling of control characters in file paths. When users drag and drop files into the application, it fails to escape these characters, potentially allowing an attacker to execute arbitrary code. This issue affects all versions of Tabby before 1.0.233, and users are advised to update to the latest version to mitigate the associated risks.

Affected Version(s)

tabby < 1.0.233

References

https://github.com/Eugeny/tabby/security/advisories/GHSA-...
x_refsource_CONFIRM

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.