tabby — Vulnerabilities & Security Advisories 8

All 8 CVE vulnerabilities found in tabby, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-72903	Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory CWE-22	8.1	High	2026-08-10
CVE-2026-46709	Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038) CWE-77	7.8	High	2026-07-15
CVE-2026-45038	Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution CWE-150	-	-	2026-05-15
CVE-2026-45036	Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh CWE-78	7.0	High	2026-05-15
CVE-2026-45035	Tabby: RCE via `tabby://run` URL Scheme CWE-78	-	-	2026-05-15
CVE-2026-45037	Tabby: Unsafe protocol handler execution via terminal linkifier allows arbitrary OS protocol invocation CWE-184	7.1	High	2026-05-15
CVE-2025-22136	Tabby has a TCC Bypass via Misconfigured Node Fuses CWE-94	7.8	-	2025-01-08
CVE-2024-55950	Tabby has a TCC Bypass via Unnecessary Permissive Entitlements in Tabby CWE-276	6.6	-	2024-12-26

All 8 known CVE vulnerabilities affecting tabby with full Chinese analysis, references, and POCs where available.