CVE-2026-45037
Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's terminal linkifier passes any detected URI directly to the operating system's protocol handler without validating the protocol scheme. This allows a malicious SSH or Telnet server to send crafted terminal output containing dangerous protocol URIs which Tabby renders as clickable links, triggering arbitrary OS protocol handlers on the victim's machine. This vulnerability is fixed in 1.0.232.
| CWE | CWE-184 CWE-601 |
| Vendor | eugeny |
| Product | tabby |
| Published | May 15, 2026 |
| Last Updated | May 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for eugeny tabby
Be the first to know when new high vulnerabilities affecting eugeny tabby are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
Eugeny / tabby
< 1.0.232