QSearchQSearch

CVE-2026-45037

7.1 HIGH

Tabby (formerly Terminus) is a highly configurable terminal emulator

Published: 2026-05-15 · Last updated: 2026-05-19

Severity and scoring

CVSS
7.1 HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CWE
CWE-184, CWE-601

Affected products

VendorProduct
tabbytabby

Description

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's terminal linkifier passes any detected URI directly to the operating system's protocol handler without validating the protocol scheme. This allows a malicious SSH or Telnet server to send crafted terminal output containing dangerous protocol URIs which Tabby renders as clickable links, triggering arbitrary OS protocol handlers on the victim's machine. This vulnerability is fixed in 1.0.232.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-45038 — Tabby (formerly Terminus) is a highly configurable terminal emulator (7.8 HIGH)
  • CVE-2026-45036 — Tabby (formerly Terminus) is a highly configurable terminal emulator (7.0 HIGH)
  • CVE-2026-45035 — Tabby (formerly Terminus) is a highly configurable terminal emulator (8.8 HIGH)

Same CWE

  • CVE-2026-46616 — Umbraco is an ASP.NET CMS (5.4 MEDIUM)
  • CVE-2026-48856 — Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data
  • CVE-2026-45566 — Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers (6.1 MEDIUM)
  • CVE-2026-53440 — Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet container" secur... (4.3 MEDIUM)
  • CVE-2026-53437 — Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenk... (4.3 MEDIUM)