CVE-2026-45037

Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation

State: Published
Severity: 7.1 High
Published: May 15, 2026
Updated: May 15, 2026
Reserved: May 8, 2026

Description

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's terminal linkifier passes any detected URI directly to the operating system's protocol handler without validating the protocol scheme. This allows a malicious SSH or Telnet server to send crafted terminal output containing dangerous protocol URIs which Tabby renders as clickable links, triggering arbitrary OS protocol handlers on the victim's machine. This vulnerability is fixed in 1.0.232.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L	GitHub_M

Weaknesses

CWE-184 Incomplete List of Disallowed Inputs
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Affected Products

Product	Versions
tabbyEugeny	< 1.0.232Affected

References

https://github.com/Eugeny/tabby/security/advisories/GHSA-cmpc-v2x9-j9x9

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.