Listen to this Post
Tabby (formerly Terminus) is a highly configurable, modern terminal emulator built for operators and developers who require extensive customization. In versions prior to 1.0.232, the application contains a vulnerability within its terminal linkifier component. When rendering text output from an active session, the terminal linkifier detects uniform resource identifiers (URIs) and passes them directly to the underlying host operating system’s default protocol handler without validating or sanitizing the protocol scheme. This behavior exposes systems to security risks when connecting to untrusted infrastructure. In a typical exploitation scenario, a malicious or compromised SSH, Telnet, or serial target emits carefully crafted terminal escape sequences and text payloads containing dangerous protocol URIs (such as custom application handlers or system command URIs). When these sequences are printed to the terminal screen, Tabby automatically formats them as clickable hyperlinks or processes them natively. If a user interacts with the rendered element or if the application automatically triggers the protocol handler, the operating system invokes the registered handler for that scheme, executing arbitrary commands or opening unauthorized applications within the context of the logged-in desktop user. Because terminal emulators routinely ingest text streams from external and potentially hostile sources, the lack of strict scheme allowlisting or validation in the link parsing mechanism undermines the trust boundary between remote data streams and local operating system execution flows.
DailyCVE Form:
Platform: Tabby Terminal
Version: Prior to 1.0.232
Vulnerability : Protocol Handler Execution
Severity : Medium
date : May 15 2026
Prediction : Patched in 1.0.232
What Undercode Say
Analysis of the linkifier module reveals that regex patterns match arbitrary URI schemes without verifying whether the prefix is restricted to safe protocols like `http` or https. When the application parses terminal text streams, it constructs anchor elements or triggers handlers dynamically:
// Conceptual pattern handling link clicks in vulnerable versions
function handleTerminalLink(uri: string) {
// Lacks scheme verification against an allowlist
const shellCommand = <code>xdg-open "${uri}"</code>;
exec(shellCommand);
}
Exploit: (Educational Purposes!)
An attacker connects via SSH or injects logs containing malicious URIs designed to invoke local application binaries or custom protocol handlers:
Example payload emitted from a controlled server stream echo -e "\e]8;;custom-handler://exploit?payload=execute\e\Click Here\e]8;;\e\"
Protection:
Upgrade Tabby to version 1.0.232 or higher, where strict scheme validation blocks unauthorized protocol handlers. Avoid connecting to untrusted SSH or Telnet endpoints.
Impact:
Allows malicious servers to trigger unintended local OS protocol handlers, potentially leading to local application abuse or arbitrary command execution via user interaction.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
