CVE-2026-45038: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences in Eugeny tabby
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, since Tabby does not escape control characters from file paths when dragging and dropping a file into it, code execution can be achieved. This vulnerability is fixed in 1.0.233.
AI Analysis
Technical Summary
Tabby, a configurable terminal emulator, suffers from improper neutralization of escape, meta, or control sequences (CWE-150) in versions before 1.0.233. Specifically, when a user drags and drops a file into the terminal, control characters in the file path are not escaped properly, which can lead to arbitrary code execution. This vulnerability has been assigned CVE-2026-45038 and carries a CVSS 4.0 score of 8.4, reflecting high severity. The issue is resolved in version 1.0.233 of Tabby.
Potential Impact
Successful exploitation allows an attacker to achieve code execution by leveraging unescaped control characters in file paths during drag-and-drop operations in Tabby versions prior to 1.0.233. This can compromise the affected system with high impact on confidentiality, integrity, and availability as indicated by the CVSS vector.
Mitigation Recommendations
Upgrade Tabby to version 1.0.233 or later, where this vulnerability is fixed. Since the vendor advisory does not provide additional remediation details, applying this official fix is the recommended action. Patch status is confirmed by the version update note in the description.
CVE-2026-45038: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences in Eugeny tabby
Description
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, since Tabby does not escape control characters from file paths when dragging and dropping a file into it, code execution can be achieved. This vulnerability is fixed in 1.0.233.
CVSS v4.0
Score 8.4high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Tabby, a configurable terminal emulator, suffers from improper neutralization of escape, meta, or control sequences (CWE-150) in versions before 1.0.233. Specifically, when a user drags and drops a file into the terminal, control characters in the file path are not escaped properly, which can lead to arbitrary code execution. This vulnerability has been assigned CVE-2026-45038 and carries a CVSS 4.0 score of 8.4, reflecting high severity. The issue is resolved in version 1.0.233 of Tabby.
Potential Impact
Successful exploitation allows an attacker to achieve code execution by leveraging unescaped control characters in file paths during drag-and-drop operations in Tabby versions prior to 1.0.233. This can compromise the affected system with high impact on confidentiality, integrity, and availability as indicated by the CVSS vector.
Mitigation Recommendations
Upgrade Tabby to version 1.0.233 or later, where this vulnerability is fixed. Since the vendor advisory does not provide additional remediation details, applying this official fix is the recommended action. Patch status is confirmed by the version update note in the description.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-08T18:07:27.341Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a075665ec166c07b072347e
Added to database: 5/15/2026, 5:22:45 PM
Last enriched: 5/23/2026, 6:22:54 AM
Last updated: 6/5/2026, 2:37:31 PM
Views: 80
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.