PT-2026-41322 · Tabby · Tabby

Published 2026-05-15 · Updated 2026-05-19 · CVE-2026-45037

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tabby versions prior to 1.0.232

Description The terminal linkifier in Tabby passes detected URIs directly to the operating system's protocol handler without validating the protocol scheme. This allows a malicious SSH or Telnet server to send crafted terminal output containing dangerous protocol URIs that are rendered as clickable links, enabling the triggering of arbitrary OS protocol handlers on the victim's machine.

Recommendations Update to version 1.0.232.

Exploit

Fix

Incomplete List of Disallowed Inputs

Open Redirect

Weakness Enumeration

CWE-184

CWE-601

Related Identifiers

CVE-2026-45037

GHSA-CMPC-V2X9-J9X9

Affected Products

Tabby

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45037.json · Exploit
• https://github.com/Eugeny/tabby/security/advisories/GHSA-cmpc-v2x9-j9x9 · Patch
• https://osv.dev/vulnerability/CVE-2026-45037 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45037 · Security Note
• https://t.me/cveNotify/164091 · Telegram Post