High severity · published May 15, 2026
CVE-2026-45037
Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation
7.1
CVSS
0.1%
EPSS
No
On KEV
Description
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's terminal linkifier passes any detected URI directly to the operating system's protocol handler without validating the protocol scheme. This allows a malicious SSH or Telnet server to send crafted terminal output containing dangerous protocol URIs which Tabby renders as clickable links, triggering arbitrary OS protocol handlers on the victim's machine. This vulnerability is fixed in 1.0.232.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
tabby · Eugeny
< 1.0.232 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45037
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45037
Mitigation
https://github.com/Eugeny/tabby/security/advisories/GHSA-cmpc-v2x9-j9x9
More from tabby
8.8
CVE-2026-45035
Tabby: RCE via `tabby://run` URL Scheme
8.6
CVE-2025-22136
Tabby has a TCC Bypass via Misconfigured Node Fuses
8.6
CVE-2024-55950
Tabby has a TCC Bypass via Unnecessary Permissive Entitlements in Tabby
8.1
CVE-2026-72903
Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory
7.8
CVE-2026-46709
Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)