EUVD-2026-44692Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:L and UI:R because the attacker must get the victim to locally drop a file and press Enter; PR:N as no app authentication is needed; C/I/A:H reflect full shell code execution.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and …, so the incomplete CVE-2026-45038 fix for control characters still allows code execution when the victim presses Enter. This issue is fixed in version 1.0.234.
AnalysisAI
Command injection in Tabby (formerly Terminus) terminal emulator before 1.0.234 lets an attacker achieve code execution by tricking a victim into dragging and dropping a crafted file whose path contains shell command-substitution metacharacters ($(...) or backticks). Because the drop handler in tabby-electron/src/pathDrop.ts inserted the raw path into the active shell without neutralizing these characters, the payload runs when the victim presses Enter. This is an incomplete-fix follow-up to CVE-2026-45038, which only addressed control characters; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Tabby is a cross-platform Electron-based terminal emulator. The vulnerable component is the PathDropDecorator in tabby-electron/src/pathDrop.ts, which handles drag-and-drop of files onto a terminal tab by injecting the dropped file's path into the underlying shell session via sendInput(). The prior fix (CVE-2026-45038) escaped backslashes and quoted paths containing spaces but did not strip or escape shell command-substitution syntax such as $(...) and backticks. This maps to CWE-77 (Command Injection): untrusted input (a filesystem path chosen by the attacker) is passed into a shell command interpreter without proper neutralization of special elements. The corrected code introduces shell-type-aware quoting - quoteForUnix wraps the path in single quotes and escapes embedded single quotes, while quoteForPowerShell and quoteForCmd apply platform-appropriate escaping, and shellType is now derived from each shell provider (bash/zsh/Cygwin/MSYS2/Git Bash as 'unix', PowerShell as 'powershell', cmd/cmder/VS dev tools as 'cmd').
RemediationAI
Vendor-released patch: 1.0.234 - upgrade Tabby to version 1.0.234 or later, which introduces shell-type-aware path quoting (fix commit e151472b951bbd472ddc0545ec8656e4c0f352da and advisory GHSA-mq9v-2pgm-fxgh at https://github.com/Eugeny/tabby/security/advisories/GHSA-mq9v-2pgm-fxgh). Until the upgrade can be applied, the practical compensating control is to avoid dragging and dropping files of unknown or untrusted origin onto a terminal tab, since the injection is triggered only through the drop-to-shell path; teams can also disable or discourage the drag-and-drop path-insertion workflow entirely, at the cost of losing that convenience feature. As an additional habit, do not press Enter after a path is inserted without first inspecting the inserted line for unexpected $(...), backtick, or other shell metacharacters - the trade-off being that this relies on user vigilance rather than a robust technical barrier.
Remote code execution in Tabby terminal emulator versions prior to 1.0.233 allows unauthenticated attackers to execute a
Local code execution in Tabby terminal emulator versions before 1.0.233 occurs when dragging and dropping files containi
Path traversal in Tabby terminal emulator (prior to 1.0.235) on Windows allows a malicious SFTP server to write or overw
Tabby terminal emulator before version 1.0.232 automatically renders malicious URIs from SSH/Telnet servers as clickable
Local code execution in Tabby terminal emulator versions before 1.0.233 occurs when users view attacker-controlled files
Same weakness CWE-77 – Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today