CVE-2026-46709
⚠️ highSummary
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and `…`, so the incomplete CVE-2026-45038 fix for control characters still allows code execution when the victim presses Enter. This issue is fixed in version 1.0.234.
CVSS Score
7.8
High
EPSS Score
0.2
Exploit Probability
Published Date
2026-07-15
First Seen: 2026-07-16
📊 Relative Risk Intelligence
This CVE is Moderate Risk - more severe than 68.7% of all 349,016 vulnerabilities in our database.
#109,221
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jul 15, 2026
🔍 Exploitation Status
Poc
Proof-of-concept available
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
SSVC data provided by
CISA
Last Modified
2026-07-30
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H