CVE-2026-46709

HIGH7.8

Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)

Published Jul 15, 2026

Modified 2 months ago

Details

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and …, so the incomplete CVE-2026-45038 fix for control characters still allows code execution when the victim presses Enter. This issue is fixed in version 1.0.234.

References

WEB

https://github.com/Eugeny/tabby/commit/e151472b951bbd472ddc0545ec8656e4c0f352da

WEB

https://github.com/Eugeny/tabby/releases/tag/v1.0.234

WEB

https://github.com/Eugeny/tabby/security/advisories/GHSA-mq9v-2pgm-fxgh

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-46709

CVSS Analysis

CVSS v3.1

7.8