Tabby, a configurable terminal emulator, allows an attacker to execute arbitrary shell commands with the user's privileges. In releases prior to 1.0.234, a dragged file path is forwarded directly to the active shell without sanitizing command‑substitution characters such as $(…) or `…`. Because the earlier CVE-2026-45038 fix handled only control characters, these metacharacters were still interpreted by the shell when the user pressed Enter, permitting code execution. This flaw corresponds to command injection (CWE‑77) and operating‑system command injection (CWE‑78) and is addressed in Tabby version 1.0.234.

Eugeny Tabby (formerly Terminus) versions earlier than 1.0.234 are affected. Users running any pre‑1.0.234 build should check their installed version and verify that it precedes the release tagged v1.0.234.

The CVSS score of 7.8 categorizes this as high severity, but the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a local attacker who can interact with the Tabby GUI to drag and drop files. An attacker with local UI access can trigger the exploit by dropping a file path that contains shell metacharacters, then pressing Enter to execute the constructed command.