CVE-2026-45035: fallo crítico en Eugeny tabby
Tabby: RCE via `tabby://run` URL Scheme
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.4epss 0.4%
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby registers itself as the handler for the tabby:// URL scheme on all platforms. The URL scheme handler supports a run command that directly executes OS commands with no user confirmation, sanitization, or sandboxing. An attacker can craft a malicious link (tabby://run?command=...) and deliver it via a website, email, chat message, or any other medium. When a victim clicks the link, the OS launches Tabby which immediately spawns the specified command as a child process with the user's full privileges. This is a zero-click-after-link-visit RCE vulnerability. This vulnerability is fixed in 1.0.233.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Productos afectados
Eugeny · tabbyCVEs relacionadas — Eugeny tabby
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-72903HIGHTabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directoryEPSS 0.5%CVE-2025-22136HIGHTabby has a TCC Bypass via Misconfigured Node FusesEPSS 0.4%CVE-2024-55950HIGHTabby has a TCC Bypass via Unnecessary Permissive Entitlements in TabbyEPSS 0.3%CVE-2026-46709HIGHTabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)EPSS 0.3%CVE-2026-45038HIGHTabby: Dragging and Dropping a File into Tabby Can Lead to Code ExecutionEPSS 0.2%CVE-2026-45037HIGHTabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocationEPSS 0.1%