CVE-2025-22136

Name of the Vulnerable Software and Affected Versions Tabby versions prior to 1.0.217

Description Tabby, a highly configurable terminal emulator, enables several high-risk Electron fuses, including RunAsNode, EnableNodeCliInspectArguments, and EnableNodeOptionsEnvironmentVariable. These fuses create potential code injection vectors despite the application being signed with a hardened runtime and lacking dangerous entitlements such as com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables.

Recommendations For versions prior to 1.0.217, update to version 1.0.217 or later to resolve the issue. As a temporary workaround, consider disabling the high-risk Electron fuses, including RunAsNode, EnableNodeCliInspectArguments, and EnableNodeOptionsEnvironmentVariable, until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation.