Tabby vulnerabilities
Products
- Tabby 5
Newest
- eugeny tabby Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038) 7.8 High
- eugeny tabby Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution 8.4 High
- eugeny tabby Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh 7.0 High
- eugeny tabby Tabby: RCE via `tabby://run` URL Scheme 9.4 Critical
- eugeny tabby Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation 7.1 High