CVE-2026-45035

Name of the Vulnerable Software and Affected Versions Tabby versions prior to 1.0.233

Description Tabby registers itself as the handler for the tabby:// URL scheme across all platforms. The handler supports a run command that executes operating system commands without user confirmation, sanitization, or sandboxing. An attacker can deliver a malicious link using the tabby://run?command=... format via websites, emails, or chat messages. When a user clicks the link, the application spawns the specified command in the command variable as a child process with the user's full privileges, leading to remote code execution (RCE).

Recommendations Update to version 1.0.233.