CVE-2026-45036: Tabby Terminal ZMODEM Flaw Enables Code Execution

The National Vulnerability Database has detailed CVE-2026-45036, a critical vulnerability in Tabby (formerly Terminus) terminal emulator versions prior to 1.0.233. This flaw allows for remote code execution when a user displays attacker-controlled content. The core issue lies in Tabby’s ZModemMiddleware, which automatically confirms ZMODEM protocol detection on all terminal session output without user interaction. When a ZRQINIT header is detected, Tabby unconditionally injects a ZRINIT response back into the active PTY.

Upon the exiting of the process that triggered the detection (e.g., cat), these injected bytes are consumed by the user’s shell as a command. For users of the fish shell, the ** prefix in the injected response can trigger recursive glob expansion, leading to the execution of an attacker-placed executable. In bash and zsh, a crafted xterm.js terminal color-query feedback can similarly inject a command containing a slash, bypassing PATH resolution. An attacker can exploit this by distributing a specially crafted file, such as within a cloned Git repository, which a user might view, leading to code execution with minimal interaction.

This vulnerability, rated with a CVSS score of 7 (HIGH), highlights a dangerous blind trust in protocol detection within terminal emulators. Defenders should recognize that seemingly innocuous actions like viewing a file can now become attack vectors. The National Vulnerability Database confirms that this issue is resolved in Tabby version 1.0.233.