CVE-2025-22136: Tabby Terminal Emulator RCE Vulnerability

CVE-2025-22136 Overview

Tabby (formerly Terminus) is a highly configurable terminal emulator built on the Electron framework. Versions prior to 1.0.217 enable several high-risk Electron Fuses, including RunAsNode, EnableNodeCliInspectArguments, and EnableNodeOptionsEnvironmentVariable. These misconfigured fuses create code injection vectors against the signed application. The flaw is tracked under [CWE-94] (Improper Control of Generation of Code) and was fixed in Tabby 1.0.217.

Critical Impact
A local attacker can abuse the enabled Electron Fuses to inject and execute arbitrary code within the context of the signed Tabby application, bypassing hardened runtime protections on macOS.

Affected Products

Tabby terminal emulator versions prior to 1.0.217
Tabby installations on macOS using the signed application bundle
Tabby installations on other Electron-supported platforms (Windows, Linux)

Discovery Timeline

2025-01-08 - CVE-2025-22136 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22136

Vulnerability Analysis

Tabby ships as an Electron application that is code-signed and uses macOS hardened runtime. Electron provides a feature called Fuses, which are build-time flags toggling runtime behaviors that affect security posture. Tabby builds prior to 1.0.217 left three sensitive fuses enabled.

The RunAsNode fuse allows the packaged Electron binary to execute as a generic Node.js interpreter when invoked with the ELECTRON_RUN_AS_NODE environment variable. The EnableNodeCliInspectArguments fuse permits --inspect style debugger flags, exposing a Node.js debugging interface. The EnableNodeOptionsEnvironmentVariable fuse honors NODE_OPTIONS, which can inject scripts at interpreter startup via flags such as --require.

Because the application is signed and trusted, code executed through these vectors inherits the application's identity and any user-granted Transparency, Consent, and Control (TCC) permissions on macOS.

Root Cause

The root cause is insecure default configuration of Electron Fuses during the application build. The project did not disable RunAsNode, EnableNodeCliInspectArguments, and EnableNodeOptionsEnvironmentVariable, despite shipping a signed binary intended to enforce code integrity.

Attack Vector

An attacker with local code execution as the current user invokes the Tabby executable with attacker-controlled environment variables or CLI arguments. Setting ELECTRON_RUN_AS_NODE=1 and NODE_OPTIONS="--require /path/to/malicious.js" causes the signed Tabby binary to load and execute attacker code as a trusted process. Alternatively, the attacker can launch Tabby with --inspect-brk and attach a debugger to evaluate arbitrary JavaScript. This technique is commonly used to bypass macOS code signing and hardened runtime restrictions, particularly when entitlements such as com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables are absent.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-prcj-7rvc-26h4 for vendor technical details.

Detection Methods for CVE-2025-22136

Indicators of Compromise

Process creation events showing the Tabby binary launched with the ELECTRON_RUN_AS_NODE environment variable set
Tabby process command lines containing --inspect, --inspect-brk, or --remote-debugging-port arguments
Tabby invocations with a populated NODE_OPTIONS environment variable referencing --require or --import paths outside the application bundle
Child processes spawned by Tabby that perform unexpected file system, network, or keychain access

Detection Strategies

Inventory installed Tabby versions across endpoints and flag any build older than 1.0.217
Hunt for process telemetry where the signed Tabby binary executes scripts from user-writable paths such as /tmp, ~/Downloads, or ~/Library/Application Support
Correlate Tabby execution with environment variable telemetry to identify Node.js fuse abuse patterns

Monitoring Recommendations

Enable command-line and environment variable capture in endpoint detection and response (EDR) telemetry on macOS, Windows, and Linux
Alert on any Electron-based signed application invoked with ELECTRON_RUN_AS_NODE=1, which is a known living-off-trusted-binaries pattern
Monitor outbound network connections initiated by the Tabby process for anomalous destinations

How to Mitigate CVE-2025-22136

Immediate Actions Required

Upgrade Tabby to version 1.0.217 or later on all endpoints where the terminal emulator is installed
Audit endpoints for prior execution of Tabby with suspicious environment variables or debug flags
Restrict the ability of standard users to set persistent environment variables that target signed applications

Patch Information

The maintainers fixed the issue in Tabby 1.0.217 by disabling the high-risk Electron Fuses during the build process. Review the upstream fix in the GitHub commit 93513541 and the GitHub Security Advisory GHSA-prcj-7rvc-26h4 for the complete advisory.

Workarounds

If immediate upgrade is not possible, remove Tabby from shared or multi-user systems where untrusted local accounts exist
Use application allowlisting to block execution of Tabby versions below 1.0.217
On macOS, deploy endpoint policies that strip ELECTRON_RUN_AS_NODE and NODE_OPTIONS from the environment of signed Electron applications where feasible

bash

# Verify installed Tabby version on macOS
/Applications/Tabby.app/Contents/MacOS/Tabby --version

# Identify vulnerable builds across an estate (example)
find /Applications -name "Tabby.app" -maxdepth 3 \
  -exec defaults read {}/Contents/Info CFBundleShortVersionString \;