Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and `…`, so the incomplete CVE-2026-45038 fix for control characters still allows code execution when the victim presses Enter. This issue is fixed in version 1.0.234.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/Eugeny/tabby/commit/e151472b951bbd472ddc0545ec8656e4c0f352da Patch
- https://github.com/Eugeny/tabby/security/advisories/GHSA-mq9v-2pgm-fxgh Exploit, Mitigation, Vendor Advisory
- https://github.com/Eugeny/tabby/security/advisories/GHSA-mq9v-2pgm-fxgh Exploit, Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.8 · tabbyNVD modified 2026-10-24 21:10
Affected (CPE criteria) 1
cpe:2.3:a:tabby:tabby:*:*:*:*:*:*:*:*
References 4
- https://github.com/Eugeny/tabby/commit/e151472b951bbd472ddc0545ec8656e4c0f352da Patch
- https://github.com/Eugeny/tabby/releases/tag/v1.0.234 Product, Release Notes
- https://github.com/Eugeny/tabby/security/advisories/GHSA-mq9v-2pgm-fxgh Exploit, Mitigation, Vendor Advisory
- https://github.com/Eugeny/tabby/security/advisories/GHSA-mq9v-2pgm-fxgh Exploit, Mitigation, Vendor Advisory