PT-2026-41322

CVE-2026-45037

Published

2026-05-15

Updated

2026-10-11

Description by

CVSS 3.1

7.1

High

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tabby versions prior to 1.0.232

Description The terminal linkifier in Tabby passes detected URIs directly to the operating system's protocol handler without validating the protocol scheme. This allows a malicious SSH or Telnet server to send crafted terminal output containing dangerous protocol URIs that are rendered as clickable links, enabling the triggering of arbitrary OS protocol handlers on the victim's machine.

Recommendations Update to version 1.0.232.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-184: Incomplete List of Disallowed Inputs

CWE-601: URL Redirection to Untrusted Site (\'Open Redirect\')

Related identifiers