| Package | Affected versions | Patched versions |
|---|---|---|
| tabby | < 1.0.234 | 1.0.234 |
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and `…`, so the incomplete CVE-2026-45038 fix for control characters still allows code execution when the victim presses Enter. This issue is fixed in version 1.0.234.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free