CVE-2026-46709: Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and …, so the incomplete CVE-2026-45038 fix for control characters still allows code execution when the victim presses Enter. This issue is fixed in version 1.0.234.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tabby (formerly Terminus) terminal emulatorto a version that resolves this vulnerability.Fixed in 1.0.234
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46709?
CVE-2026-46709 has a high severity rating of 7.8.
What types of vulnerabilities are associated with CVE-2026-46709?
CVE-2026-46709 is associated with command injection and OS command injection vulnerabilities.
How do I fix CVE-2026-46709?
To fix CVE-2026-46709, update Tabby to version 1.0.234 or later, which addresses the incomplete fix for the previous vulnerability.
What software is affected by CVE-2026-46709?
CVE-2026-46709 affects the Tabby terminal emulator software prior to version 1.0.234.
What issue does CVE-2026-46709 represent in Tabby?
CVE-2026-46709 represents a drag-and-drop path injection vulnerability that allows remote code execution via shell command substitution.