CVE-2026-46709

Katalog CVE

CVSS 7.8 · High EPSS 0,25%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada tabby. Skor CVSS 3.1 7.8 (High) menurut github.com.

Deskripsi (NVD)

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and `…`, so the incomplete CVE-2026-45038 fix for control characters still allows code execution when the victim presses Enter. This issue is fixed in version 1.0.234.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

30 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Eugeny/tabby/security/advisories/GHSA-mq9v-2pgm-fxgh exploit · mitigasi · advisory vendor
• https://github.com/Eugeny/tabby/commit/e151472b951bbd472ddc0545ec8656e4c0f352da patch
• https://github.com/Eugeny/tabby/releases/tag/v1.0.234 product · release notes