CVE-2026-45035: Tabby: RCE via `tabby://run` URL Scheme

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-05-15 · updated 2026-10-26
Weakness: CWE-78

Description

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby registers itself as the handler for the tabby:// URL scheme on all platforms. The URL scheme handler supports a run command that directly executes OS commands with no user confirmation, sanitization, or sandboxing. An attacker can craft a malicious link (tabby://run?command=...) and deliver it via a website, email, chat message, or any other medium. When a victim clicks the link, the OS launches Tabby which immediately spawns the specified command as a child process with the user's full privileges. This is a zero-click-after-link-visit RCE vulnerability. This vulnerability is fixed in 1.0.233.

Affected products

Eugeny tabby: before 1.0.233 — fixed in 1.0.233

How to fix

Upgrade to a fixed version: Eugeny tabby 1.0.233. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-45035 or the next vulnerability affects your stack