CVE-2026-45037: Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-15 · updated 2026-10-26
Weakness: CWE-184

Description

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's terminal linkifier passes any detected URI directly to the operating system's protocol handler without validating the protocol scheme. This allows a malicious SSH or Telnet server to send crafted terminal output containing dangerous protocol URIs which Tabby renders as clickable links, triggering arbitrary OS protocol handlers on the victim's machine. This vulnerability is fixed in 1.0.232.

Affected products

Eugeny tabby: before 1.0.232 — fixed in 1.0.232

How to fix

Upgrade to a fixed version: Eugeny tabby 1.0.232. Check the vendor advisory for mitigations.

References

https://github.com/Eugeny/tabby/security/advisories/GHSA-cmpc-v2x9-j9x9

Get alerted when CVE-2026-45037 or the next vulnerability affects your stack