Advisories · Technology
Eugeny tabby.
Every CVE that names Eugeny tabby among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.1 High
Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory
- Eugeny tabby
- Path traversal
- CVSS 7.8 High
Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)
- Eugeny tabby
- Command injection
- CVSS 8.4 High
Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution
- Eugeny tabby
- CWE-150
- CVSS 7.0 High
Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh
- Eugeny tabby
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Tabby: RCE via `tabby://run` URL Scheme
- Eugeny tabby
- Command injection
- CVSS 7.1 High
Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation
- Eugeny tabby
- Open redirect
- CWE-184
- CVSS 8.6 High
Tabby has a TCC Bypass via Misconfigured Node Fuses
- Eugeny tabby
- Code injection
- CVSS 8.6 High
Tabby has a TCC Bypass via Unnecessary Permissive Entitlements in Tabby
- Eugeny tabby
- Broken access control