CyberRota Analysis
AI-GeneratedTabby, a terminal emulator, is vulnerable to command injection due to improper handling of dropped file paths, allowing attackers to execute arbitrary commands when a user presses Enter. This flaw poses a significant risk for users who rely on Tabby for terminal operations, particularly in environments where untrusted files may be processed. Organizations using versions prior to 1.0.234 should prioritize upgrading to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and `…`, so the incomplete CVE-2026-45038 fix for control characters still allows code execution when the victim presses Enter. This issue is fixed in version 1.0.234.
Related CVEs
Other vulnerabilities affecting the same vendor(s)