High severity · published Jan 8, 2025
CVE-2025-22136
Tabby has a TCC Bypass via Misconfigured Node Fuses
8.6
CVSS
0.4%
EPSS
No
On KEV
Description
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.217 , Tabby enables several high-risk Electron Fuses, including RunAsNode, EnableNodeCliInspectArguments, and EnableNodeOptionsEnvironmentVariable. These fuses create potential code injection vectors even though the application is signed with hardened runtime and lacks dangerous entitlements such as com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables. This vulnerability is fixed in 1.0.217.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
tabby · Eugeny
< 1.0.217 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-22136
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-22136
github.com
https://github.com/Eugeny/tabby/commit/93513541f7161fa8a59491603cabb6a101c0c08e
github.com
https://github.com/Eugeny/tabby/security/advisories/GHSA-prcj-7rvc-26h4
More from tabby
8.8
CVE-2026-45035
Tabby: RCE via `tabby://run` URL Scheme
8.6
CVE-2024-55950
Tabby has a TCC Bypass via Unnecessary Permissive Entitlements in Tabby
8.1
CVE-2026-72903
Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory
7.8
CVE-2026-46709
Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)
7.8
CVE-2026-45038
Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution