CVE-2026-46709
Received Received - Intake

Command Injection in Tabby Terminal Emulator

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and `…`, so the incomplete CVE-2026-45038 fix for control characters still allows code execution when the victim presses Enter. This issue is fixed in version 1.0.234.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-15
Last Modified
2026-07-15
Generated
2026-07-15
AI Q&A
2026-07-15
EPSS Evaluated
N/A
NVD
CVE-2026-46709
EUVD
EUVD-2026-44692

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
eugeny tabby 1.0.234
eugeny tabby to 1.0.234 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-46709 is a vulnerability in Tabby terminal emulator where dragging and dropping a file with a specially crafted name into the terminal could execute arbitrary commands embedded in the file name. The issue occurs because Tabby inserts file paths without properly neutralizing shell metacharacters like $(...) or `...`, allowing command substitution when the user presses Enter.

Detection Guidance

To detect this vulnerability, check if your Tabby version is below 1.0.234. Run 'tabby --version' or check the application's about section. If vulnerable, inspect logs for unusual command execution after dragging files into the terminal.

Mitigation Strategies

Upgrade Tabby to version 1.0.234 or later immediately. If upgrading is not possible, avoid dragging files from untrusted sources into the terminal. Enable bracketed-paste mode in your shell to prevent immediate command execution.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your system with your user privileges. An attacker could trick you into dragging a malicious file into Tabby, which would then run embedded commands when you press Enter. This could lead to data theft, malware installation, or system compromise without requiring elevated permissions.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data protection requirements under GDPR or HIPAA. If exploited, it may result in unauthorized access to sensitive data, triggering compliance breaches that require reporting and mitigation under these regulations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46709. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart