CVE-2026-45038 — Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution

CVE-2026-45038

Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution PUBLISHED

Description (CNA)

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, since Tabby does not escape control characters from file paths when dragging and dropping a file into it, code execution can be achieved. This vulnerability is fixed in 1.0.233.

Affected (CNA)

Vendor / product	Versions
Eugeny / tabby	affected < 1.0.233

CWE

CWE-150

References

https://github.com/Eugeny/tabby/security/advisories/GHSA-m937-jm93-pfp6

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.