What is CVE-2026-45037?

CVE-2026-45037 is a high-severity vulnerability in Eugeny Tabby, classified under Incomplete List of Disallowed Inputs. CVSS score: 7.1/10. Published 2026-05-15.

How severe is CVE-2026-45037?

High severity. CVSS v3 base score is 7.1 out of 10.

Open Redirect in Eugeny Tabby

CVE-2026-45037

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's terminal linkifier passes any detected URI directly to the operating system's protocol handler without validating the protocol scheme. This allows a malicious SSH or Telnet server to send crafted terminal output containing dangerous protocol URIs which Tabby renders as clickable links, triggering arbitrary OS protocol handlers on the victim's machine. This vulnerability is fixed in 1.0.232.

EPSS: 0.001 (3.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.

Affected products

Eugeny Tabby — versions < 1.0.232
Tabby

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Patch, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2026-45037?: CVE-2026-45037 is a high-severity vulnerability in Eugeny Tabby, classified under Incomplete List of Disallowed Inputs. CVSS score: 7.1/10. Published 2026-05-15.
How severe is CVE-2026-45037?: High severity. CVSS v3 base score is 7.1 out of 10.