Tabby registers itself as the handler for the tabby:// URL scheme on all platforms. A crafted link such as tabby://run?command=… causes Tabby to execute the supplied operating‑system command without any confirmation, sanitization or sandboxing, allowing the attacker to run arbitrary code with the victim’s full privileges. This flaw, identified as CWE-78, can compromise confidentiality, integrity, and availability of the system. Based on the description, the likely attack vector is a user merely clicking a malicious link embedded in a website, email, chat message or similar medium.

This issue affects the Tabby terminal emulator (formerly Terminus) from vendor Eugeny. All versions prior to 1.0.233 are affected, as the vulnerability exists only in releases older than that fixed version.

The CVSS score of 9.4 indicates a high‑severity vulnerability. The EPSS score is currently unavailable, but the flaw is listed as not in the CISA KEV catalog. An attacker can exploit the vulnerability by delivering a malicious tabby://run link; once the victim activates the link, OS command execution occurs immediately, giving the attacker full control. No user interaction beyond clicking the link is required, making it a zero‑click-after‑link‑visit Remote Code Execution.