VULNERABILITY INTELLIGENCE

CVE-2026-46709

CVSS score7.8 HIGH

EPSS probability0.25%

CISA KEVNot currently listed

Published2026-07-15

Last modified2026-10-24

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and `…`, so the incomplete CVE-2026-45038 fix for control characters still allows code execution when the victim presses Enter. This issue is fixed in version 1.0.234.

Weakness classification

security-advisories@github.com: CWE-77

Primary references

security-advisories@github.com — Patch
security-advisories@github.com — Product, Release Notes
security-advisories@github.com — Exploit, Mitigation, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Mitigation, Vendor Advisory