CVE-2026-45038
Tabby (formerly Terminus) is a highly configurable terminal emulator.
Published May 15, 2026 · updated Jun 17, 2026 · tabby tabby
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, since Tabby does not escape control characters from file paths when dragging and dropping a file into it, code execution can be achieved. This vulnerability is fixed in 1.0.233.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 15, 2026 · NIST NVD
Detected
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, since Tabby does not escape control characters from file paths when dragging and dropping a file into it, code execution can be achieved. This vulnerability is fixed in 1.0.233.
Jun 17, 2026 · NIST NVD
Updated
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, since Tabby does not escape control characters from file paths when dragging and dropping a file into it, code execution can be achieved. This vulnerability is fixed in 1.0.233.
Affected
- cpe tabby/tabbyversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-45038
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-45038
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, since Tabby does not escape control characters from file paths when dragging and dropping a file into it, code execution can be achieved. This vulnerability is fixed in 1.0.233.
nvd.nist.gov