The vulnerability identified as CVE-2026-45038 affects versions of Eugeny Tabby before 1.0.233. It involves improper neutralization of escape, meta, or control sequences (CWE-150) in file paths during drag-and-drop operations. Because control characters are not escaped, an attacker can craft file paths that execute arbitrary code when dropped into the terminal emulator. The vulnerability has a high CVSS 4.0 score of 8.4, reflecting local attack vector with low complexity but requiring user interaction. The issue is resolved in Tabby version 1.0.233.

Successful exploitation allows an attacker to achieve code execution on the affected system by leveraging unescaped control characters in file paths during drag-and-drop operations in Tabby. This can lead to compromise of the user's environment with high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Upgrade Eugeny Tabby to version 1.0.233 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 1.0.233, applying this official update is the recommended remediation. No additional mitigations are indicated by the vendor.