Which versions of Tabby are affected by EUVD-2026-30572?

Tabby terminal emulator versions before 1.0.233 contain a local code execution vulnerability triggered by dragging files with malicious names into the terminal, allowing attackers to execute…. A patch is available.

How to fix or mitigate EUVD-2026-30572?

Within 24 hours: Identify all systems running Tabby terminal emulator and document current versions via endpoint management tools. Within 7 days: Advise users to upgrade to Tabby version 1.0.233 or later, and restrict file drag-and-drop operations into terminal windows via user training pending patches. Within 30 days: Verify upgrade completion across all endpoints and confirm no version prior to 1.0.233 remains in production environments.

Tabby EUVD-2026-30572

Q: What is the CVSS score of EUVD-2026-30572?

EUVD-2026-30572 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-45038 HIGH

Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)

2026-05-15 GitHub_M

RCE Tabby

8.4

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

May 15, 2026 - 18:02 EUVD

Analysis Generated

May 15, 2026 - 17:31 vuln.today

CVSS changed

May 15, 2026 - 17:22 NVD

8.4 (HIGH)

DescriptionGitHub Advisory

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, since Tabby does not escape control characters from file paths when dragging and dropping a file into it, code execution can be achieved. This vulnerability is fixed in 1.0.233.

AnalysisAI

Local code execution in Tabby terminal emulator versions before 1.0.233 occurs when dragging and dropping files containing control characters in their paths. The terminal fails to properly escape control sequences, allowing attackers to execute arbitrary commands through crafted filenames when a user drags a malicious file into the terminal window.

Technical ContextAI

Tabby (formerly known as Terminus) is a cross-platform terminal emulator built with web technologies. The vulnerability stems from improper neutralization of control characters (CWE-150) in file paths during drag-and-drop operations. When a file is dropped into the terminal, its path is inserted without proper sanitization, allowing embedded terminal control sequences to be interpreted and executed by the underlying shell.

RemediationAI

Vendor-released patch: upgrade to Tabby version 1.0.233 or later which properly escapes control characters in file paths. The fix is confirmed in the CVE description. As an immediate workaround, avoid dragging and dropping files from untrusted sources into Tabby terminals, especially files with unusual or suspicious names containing special characters. Consider using standard copy-paste operations for file paths instead of drag-and-drop until patching is complete.