Tabby CVE-2026-45038

Successful exploitation requires a user to physically drag and drop a malicious file into an open Tabby terminal window. The attacker must have already delivered a file with crafted control characters in its path to the victim's system. No special Tabby configuration is required - the vulnerability affects default installations. Exploitation is limited by the need for user interaction and local file system access.

The CVSS 4.0 score of 8.4 reflects high impact but requires local access and user interaction (drag-and-drop action). The attack vector (AV:L) and user interaction requirement (UI:A) significantly limit exploitation compared to remote vulnerabilities. No EPSS data or KEV listing indicates this is not being actively exploited in the wild. The RCE tag confirms code execution capability, but exploitation requires physical or remote desktop access to the victim's machine and social engineering to make them drag a malicious file. This represents a moderate real-world risk primarily in targeted attack scenarios.

An attacker creates a file with terminal control sequences embedded in its filename, then tricks a user into downloading it and dragging it into their Tabby terminal. When dropped, the unescaped control characters execute commands in the terminal context, potentially installing malware or exfiltrating data with the user's privileges.