CVE-2026-46709

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and `…`, so the incomplete CVE-2026-45038 fix for control characters still allows code execution when the victim presses Enter. This issue is fixed in version 1.0.234.

• CWE-77
• CWE-78

• https://github.com/Eugeny/tabby/commit/e151472b951bbd472ddc0545ec8656e4c0f352daPatch
• https://github.com/Eugeny/tabby/releases/tag/v1.0.234Product, Release Notes
• https://github.com/Eugeny/tabby/security/advisories/GHSA-mq9v-2pgm-fxghExploit, Mitigation, Vendor Advisory
• https://github.com/Eugeny/tabby/security/advisories/GHSA-mq9v-2pgm-fxghExploit, Mitigation, Vendor Advisory

Published

Jul 15, 2026

Last Modified

Jul 30, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4670Authentication bypass by primary weakness vulnerability in P…9.8
• CVE-2026-46700Actual is a local-first personal finance tool. Prior to 26.6…4.3
• CVE-2026-46701Network-AI is a TypeScript/Node.js multi-agent orchestrator.…7.6
• CVE-2026-46702Russh is a Rust SSH client & server library. From version 0.…7.5
• CVE-2026-46703Boxlite is a sandbox service that allows users to create lig…9.6
• CVE-2026-46705Russh is a Rust SSH client & server library. From version 0.…5.3
• CVE-2026-46710Notepad++ is a free and open-source source code editor. From…7.8
• CVE-2026-46712Misskey is an open source, federated social media platform. …2.3
• CVE-2026-46713Misskey is an open source, federated social media platform. …9.2
• CVE-2026-46714Misskey is an open source, federated social media platform. …5.1
• CVE-2026-46715Flask-Security-Too allows users to add security features to …5.3
• CVE-2026-46716Nezha Monitoring is a self-hostable, lightweight, servers an…9.9