PT-2026-60200 · Eugeny · Tabby

Publicado 2026-07-15 · Atualizado 2026-07-15 · CVE-2026-46709

NVD

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and …, so the incomplete CVE-2026-45038 fix for control characters still allows code execution when the victim presses Enter. This issue is fixed in version 1.0.234.

Exploit

Correção

Command Injection

OS Command Injection

Enumeração de Fraquezas

CWE-77

CWE-78

Identificadores relacionados

CVE-2026-46709

Produtos afetados

Tabby

Referências · 4

• 🔥 https://github.com/Eugeny/tabby/security/advisories/GHSA-mq9v-2pgm-fxgh · Exploit
• https://github.com/Eugeny/tabby/releases/tag/v1.0.234 · Nota
• https://github.com/Eugeny/tabby/commit/e151472b951bbd472ddc0545ec8656e4c0f352da · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-46709 · Nota de Segurança