CVE-2024-55950

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.216, Tabby terminal emulator contains overly permissive entitlements that are unnecessary for its core functionality and plugin system, creating potential security vulnerabilities. The application currently holds powerful permissions including camera, microphone access, and the ability to access personal folders (Downloads, Documents, etc.) through Apple Events, while also maintaining dangerous entitlements that enable code injection. The concerning entitlements are com.apple.security.cs.allow-dyld-environment-variables and com.apple.security.cs.disable-library-validation. Since Tabby's plugins and themes are NodeJS-based without native libraries or frameworks, and no environment variables are used in the codebase, it is recommended to review and remove at least one of the entitlements (com.apple.security.cs.disable-library-validation or com.apple.security.cs.allow-dyld-environment-variables) to prevent DYLD_INSERT_LIBRARIES injection while maintaining full application functionality. This vulnerability is fixed in 1.0.216.

• CWE-276

• https://github.com/Eugeny/tabby/commit/e1e6e1cdab0310a881e36afd7c2744e5f905518b
• https://github.com/Eugeny/tabby/security/advisories/GHSA-jx33-9jc7-24gc
• https://github.com/Eugeny/tabby/security/advisories/GHSA-jx33-9jc7-24gc

Published

Dec 26, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-55945TYPO3 is a free and open source Content Management Framework…6.5
• CVE-2024-55946Playloom Engine is an open-source, high-performance game dev…8.7
• CVE-2024-55947Gogs is an open source self-hosted Git service. A malicious …8.8
• CVE-2024-55948Discourse is an open source platform for community discussio…8.2
• CVE-2024-55949MinIO is a high-performance, S3 compatible object store, ope…9.3
• CVE-2024-5595The Essential Blocks WordPress plugin before 4.7.0 does not…5.4
• CVE-2024-55951Metabase is an open-source data analytics platform. For new …4.8
• CVE-2024-55952DataEase is an open source business analytics tool. Authenti…8.8
• CVE-2024-55953DataEase is an open source business analytics tool. Authenti…8.1
• CVE-2024-55954OpenObserve is a cloud-native observability platform. A vuln…8.7
• CVE-2024-55955An incorrect permissions assignment vulnerability in Trend M…7.3
• CVE-2024-55956In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, a…9.8