CVE-2026-45035: Tabby Terminal Emulator RCE Vulnerability

CVE-2026-45035 Overview

CVE-2026-45035 is a command injection vulnerability in Tabby, a configurable terminal emulator formerly known as Terminus. Versions prior to 1.0.233 register Tabby as the handler for the tabby:// URL scheme on all supported platforms. The handler exposes a run command that executes operating system commands without confirmation, sanitization, or sandboxing. An attacker can craft a tabby://run?command=... link and deliver it through a website, email, or chat message. Clicking the link launches Tabby and immediately spawns the attacker-supplied command under the victim's account. The flaw is tracked as [CWE-78] OS Command Injection and resolved in version 1.0.233.

Critical Impact

A single click on a malicious tabby:// link grants attackers remote code execution with the victim's full user privileges, with no further interaction required.

Affected Products

• Tabby (formerly Terminus) terminal emulator versions prior to 1.0.233
• All desktop platforms where Tabby registers the tabby:// URL scheme handler (Windows, macOS, Linux)
• Any system where a browser, mail client, or messaging app can launch registered URL handlers

Discovery Timeline

• 2026-05-15 - CVE-2026-45035 published to NVD
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-45035

Vulnerability Analysis

Tabby registers itself as the system handler for the custom tabby:// URL scheme during installation. When the operating system receives a URL with this scheme, it launches Tabby and passes the URL as a parameter. Tabby parses the URL and dispatches the embedded action. The run action accepts a command parameter and forwards its value directly to the host shell for execution.

The handler does not prompt the user, validate the caller, or restrict the command surface. Any application capable of launching a URL — including web browsers, email clients, document viewers, and instant messengers — can therefore trigger arbitrary command execution. The exploit chain requires only that a victim clicks a link once Tabby is installed.

Root Cause

The root cause is the absence of input validation and user confirmation in the tabby:// URL scheme handler. The run command treats untrusted URL input as a trusted shell instruction. There is no allowlist of safe actions, no command sanitization, and no sandboxing of the spawned process. The vulnerability maps to [CWE-78] Improper Neutralization of Special Elements used in an OS Command.

Attack Vector

The attack vector is network-based with passive user interaction. An attacker hosts or distributes a link of the form tabby://run?command=<payload>. Delivery channels include phishing emails, malicious advertisements, compromised websites, chat messages, and shared documents. When the victim clicks the link, the browser hands the URL to the operating system, which invokes Tabby. Tabby then spawns the attacker's command as a child process inheriting the user's privileges. Payloads can download additional malware, exfiltrate data, or establish persistent access.

Detection Methods for CVE-2026-45035

Indicators of Compromise

• Process trees in which tabby (or Tabby.exe) is the parent of cmd.exe, powershell.exe, bash, sh, zsh, or scripting interpreters shortly after a browser or mail client launches
• Command-line arguments to Tabby containing the substring tabby://run?command=
• Outbound network connections initiated by child processes of Tabby to previously unseen hosts
• Browser history or email metadata referencing tabby:// URIs from untrusted senders

Detection Strategies

• Hunt for parent-child relationships where a browser, mail client, or chat application launches tabby followed by an immediate shell or interpreter spawn
• Inspect Windows registry keys under HKCR\tabby\shell\open\command and equivalent macOS/Linux handlers for unexpected modifications
• Correlate URL-handler invocations with subsequent file writes, scheduled task creation, or credential access events

Monitoring Recommendations

• Enable command-line auditing and process creation logging (Windows Event ID 4688, Sysmon Event ID 1, Linux auditd execve)
• Forward endpoint telemetry to a centralized analytics platform and alert on Tabby process ancestry anomalies
• Track installed Tabby versions across the fleet and flag hosts running builds below 1.0.233

How to Mitigate CVE-2026-45035

Immediate Actions Required

• Upgrade Tabby to version 1.0.233 or later on every endpoint where it is installed
• Inventory systems using software asset management tooling to identify outdated Tabby installations
• Instruct users to avoid clicking tabby:// links from untrusted sources until patching is complete
• Block or strip tabby:// URIs at email and messaging security gateways pending remediation

Patch Information

The maintainers released a fix in Tabby 1.0.233, which removes or restricts the unsafe run action in the tabby:// URL scheme handler. Patch details and the upstream advisory are published in the Tabby GitHub Security Advisory GHSA-hf8h-rjrf-3jg6. Administrators should obtain the update through the official Tabby release channel and validate the version after deployment.

Workarounds

• Unregister the tabby:// URL scheme handler from the operating system until the patched version is installed
• On Windows, remove the HKCR\tabby registry hive; on macOS, edit LSHandlers via lsregister; on Linux, remove the x-scheme-handler/tabby association from mimeapps.list
• Apply browser policies that prompt before launching external protocol handlers, reducing zero-click exposure

# Configuration example: unregister the tabby:// handler on Linux
xdg-mime default '' x-scheme-handler/tabby
sed -i '/x-scheme-handler\/tabby/d' ~/.config/mimeapps.list

# Verify Tabby version meets the fixed release
tabby --version   # expect 1.0.233 or higher