Tabby, a configurable terminal emulator, fails to escape control characters in file paths when a user drags and drops a file into the terminal. This flaw allows an attacker to inject arbitrary commands that are then executed by Tabby’s shell, leading to unauthorized code execution. The weakness is a classic example of improper processing of user-controlled input, represented by CWE-150.

All users running Tabby versions prior to 1.0.233 are affected. The vendor Eugeny’s current version 1.0.233 and later includes the fix. Earlier releases that have not been patched remain vulnerable.

The CVSS score of 8.4 indicates high severity. EPSS is not available, suggesting the exploit probability cannot be quantified but the flaw is known to be exploitable. The vulnerability is not listed in CISA KEV, implying there is no publicly confirmed exploitation yet. The likely attack vector is local: a user who can place a file into the session can trigger execution. Remote exploitation would require a compromised user or privileged access.