Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby before 1.0.233 automatically confirms ZMODEM protocol detection on all terminal session output without user interaction, enabling shell command execution when a user displays attacker-controlled content. The ZModemMiddleware in tabby-terminal consumes all session output through a Zmodem.Sentry, and when a ZMODEM ZRQINIT header is detected, unconditionally calls detection.confirm() and writes a fixed ZRINIT response ( **\x18B0100000023be50\r\n\x11) back into the active PTY as input. When the process that triggered the detection (e.g., cat) exits, the injected bytes are consumed by the user's shell as a command line. Under fish (default configuration), the ** prefix triggers recursive glob expansion against the current directory, allowing an attacker-placed executable at a matching nested path (e.g., d/xB0100000023be50) to be executed by relative pathname without relying on PATH. Under bash and zsh, a secondary xterm.js terminal color-query feedback (OSC 10) can be combined in the same file to inject a slash-containing command word that similarly bypasses PATH resolution. An attacker can exploit this by providing a crafted file (e.g., in a cloned Git repository) that a user displays with cat, achieving code execution with no interaction beyond viewing the file. This vulnerability is fixed in 1.0.233.

• https://github.com/Eugeny/tabby/security/advisories/GHSA-qr3x-j8g9-xhf6

• Tabby » Tabby » Version: 0.0.1
  cpe:2.3:a:tabby:tabby:0.0.1
• Tabby » Tabby » Version: 1.0.0
  cpe:2.3:a:tabby:tabby:1.0.0
• Tabby » Tabby » Version: 1.0.1
  cpe:2.3:a:tabby:tabby:1.0.1
• Tabby » Tabby » Version: 1.0.100
  cpe:2.3:a:tabby:tabby:1.0.100
• Tabby » Tabby » Version: 1.0.101
  cpe:2.3:a:tabby:tabby:1.0.101
• Tabby » Tabby » Version: 1.0.102
  cpe:2.3:a:tabby:tabby:1.0.102
• Tabby » Tabby » Version: 1.0.103
  cpe:2.3:a:tabby:tabby:1.0.103
• Tabby » Tabby » Version: 1.0.104
  cpe:2.3:a:tabby:tabby:1.0.104
• Tabby » Tabby » Version: 1.0.105
  cpe:2.3:a:tabby:tabby:1.0.105
• Tabby » Tabby » Version: 1.0.106
  cpe:2.3:a:tabby:tabby:1.0.106
• Tabby » Tabby » Version: 1.0.107
  cpe:2.3:a:tabby:tabby:1.0.107
• Tabby » Tabby » Version: 1.0.108
  cpe:2.3:a:tabby:tabby:1.0.108
• Tabby » Tabby » Version: 1.0.109
  cpe:2.3:a:tabby:tabby:1.0.109
• Tabby » Tabby » Version: 1.0.110
  cpe:2.3:a:tabby:tabby:1.0.110
• Tabby » Tabby » Version: 1.0.111
  cpe:2.3:a:tabby:tabby:1.0.111
• Tabby » Tabby » Version: 1.0.112
  cpe:2.3:a:tabby:tabby:1.0.112
• Tabby » Tabby » Version: 1.0.113
  cpe:2.3:a:tabby:tabby:1.0.113
• Tabby » Tabby » Version: 1.0.114
  cpe:2.3:a:tabby:tabby:1.0.114
• Tabby » Tabby » Version: 1.0.115
  cpe:2.3:a:tabby:tabby:1.0.115
• Tabby » Tabby » Version: 1.0.116
  cpe:2.3:a:tabby:tabby:1.0.116
• Tabby » Tabby » Version: 1.0.117
  cpe:2.3:a:tabby:tabby:1.0.117
• Tabby » Tabby » Version: 1.0.118
  cpe:2.3:a:tabby:tabby:1.0.118
• Tabby » Tabby » Version: 1.0.119
  cpe:2.3:a:tabby:tabby:1.0.119
• Tabby » Tabby » Version: 1.0.120
  cpe:2.3:a:tabby:tabby:1.0.120
• Tabby » Tabby » Version: 1.0.121
  cpe:2.3:a:tabby:tabby:1.0.121
• Tabby » Tabby » Version: 1.0.122
  cpe:2.3:a:tabby:tabby:1.0.122
• Tabby » Tabby » Version: 1.0.123
  cpe:2.3:a:tabby:tabby:1.0.123
• Tabby » Tabby » Version: 1.0.124
  cpe:2.3:a:tabby:tabby:1.0.124
• Tabby » Tabby » Version: 1.0.125
  cpe:2.3:a:tabby:tabby:1.0.125
• Tabby » Tabby » Version: 1.0.126
  cpe:2.3:a:tabby:tabby:1.0.126
• Tabby » Tabby » Version: 1.0.127
  cpe:2.3:a:tabby:tabby:1.0.127
• Tabby » Tabby » Version: 1.0.128
  cpe:2.3:a:tabby:tabby:1.0.128
• Tabby » Tabby » Version: 1.0.129
  cpe:2.3:a:tabby:tabby:1.0.129
• Tabby » Tabby » Version: 1.0.130
  cpe:2.3:a:tabby:tabby:1.0.130
• Tabby » Tabby » Version: 1.0.131
  cpe:2.3:a:tabby:tabby:1.0.131
• Tabby » Tabby » Version: 1.0.132
  cpe:2.3:a:tabby:tabby:1.0.132
• Tabby » Tabby » Version: 1.0.133
  cpe:2.3:a:tabby:tabby:1.0.133
• Tabby » Tabby » Version: 1.0.134
  cpe:2.3:a:tabby:tabby:1.0.134
• Tabby » Tabby » Version: 1.0.135
  cpe:2.3:a:tabby:tabby:1.0.135
• Tabby » Tabby » Version: 1.0.136
  cpe:2.3:a:tabby:tabby:1.0.136
• Tabby » Tabby » Version: 1.0.137
  cpe:2.3:a:tabby:tabby:1.0.137
• Tabby » Tabby » Version: 1.0.138
  cpe:2.3:a:tabby:tabby:1.0.138
• Tabby » Tabby » Version: 1.0.139
  cpe:2.3:a:tabby:tabby:1.0.139
• Tabby » Tabby » Version: 1.0.140
  cpe:2.3:a:tabby:tabby:1.0.140
• Tabby » Tabby » Version: 1.0.141
  cpe:2.3:a:tabby:tabby:1.0.141
• Tabby » Tabby » Version: 1.0.142
  cpe:2.3:a:tabby:tabby:1.0.142
• Tabby » Tabby » Version: 1.0.143
  cpe:2.3:a:tabby:tabby:1.0.143
• Tabby » Tabby » Version: 1.0.144
  cpe:2.3:a:tabby:tabby:1.0.144
• Tabby » Tabby » Version: 1.0.145
  cpe:2.3:a:tabby:tabby:1.0.145
• Tabby » Tabby » Version: 1.0.146
  cpe:2.3:a:tabby:tabby:1.0.146
• Tabby » Tabby » Version: 1.0.147
  cpe:2.3:a:tabby:tabby:1.0.147
• Tabby » Tabby » Version: 1.0.148
  cpe:2.3:a:tabby:tabby:1.0.148
• Tabby » Tabby » Version: 1.0.149
  cpe:2.3:a:tabby:tabby:1.0.149
• Tabby » Tabby » Version: 1.0.150
  cpe:2.3:a:tabby:tabby:1.0.150
• Tabby » Tabby » Version: 1.0.151
  cpe:2.3:a:tabby:tabby:1.0.151
• Tabby » Tabby » Version: 1.0.152
  cpe:2.3:a:tabby:tabby:1.0.152
• Tabby » Tabby » Version: 1.0.153
  cpe:2.3:a:tabby:tabby:1.0.153
• Tabby » Tabby » Version: 1.0.154
  cpe:2.3:a:tabby:tabby:1.0.154
• Tabby » Tabby » Version: 1.0.155
  cpe:2.3:a:tabby:tabby:1.0.155
• Tabby » Tabby » Version: 1.0.156
  cpe:2.3:a:tabby:tabby:1.0.156
• Tabby » Tabby » Version: 1.0.157
  cpe:2.3:a:tabby:tabby:1.0.157
• Tabby » Tabby » Version: 1.0.158
  cpe:2.3:a:tabby:tabby:1.0.158
• Tabby » Tabby » Version: 1.0.159
  cpe:2.3:a:tabby:tabby:1.0.159
• Tabby » Tabby » Version: 1.0.160
  cpe:2.3:a:tabby:tabby:1.0.160
• Tabby » Tabby » Version: 1.0.161
  cpe:2.3:a:tabby:tabby:1.0.161
• Tabby » Tabby » Version: 1.0.162
  cpe:2.3:a:tabby:tabby:1.0.162
• Tabby » Tabby » Version: 1.0.163
  cpe:2.3:a:tabby:tabby:1.0.163
• Tabby » Tabby » Version: 1.0.164
  cpe:2.3:a:tabby:tabby:1.0.164
• Tabby » Tabby » Version: 1.0.165
  cpe:2.3:a:tabby:tabby:1.0.165
• Tabby » Tabby » Version: 1.0.166
  cpe:2.3:a:tabby:tabby:1.0.166
• Tabby » Tabby » Version: 1.0.167
  cpe:2.3:a:tabby:tabby:1.0.167
• Tabby » Tabby » Version: 1.0.168
  cpe:2.3:a:tabby:tabby:1.0.168
• Tabby » Tabby » Version: 1.0.169
  cpe:2.3:a:tabby:tabby:1.0.169
• Tabby » Tabby » Version: 1.0.170
  cpe:2.3:a:tabby:tabby:1.0.170
• Tabby » Tabby » Version: 1.0.171
  cpe:2.3:a:tabby:tabby:1.0.171
• Tabby » Tabby » Version: 1.0.172
  cpe:2.3:a:tabby:tabby:1.0.172
• Tabby » Tabby » Version: 1.0.173
  cpe:2.3:a:tabby:tabby:1.0.173
• Tabby » Tabby » Version: 1.0.174
  cpe:2.3:a:tabby:tabby:1.0.174
• Tabby » Tabby » Version: 1.0.175
  cpe:2.3:a:tabby:tabby:1.0.175
• Tabby » Tabby » Version: 1.0.176
  cpe:2.3:a:tabby:tabby:1.0.176
• Tabby » Tabby » Version: 1.0.177
  cpe:2.3:a:tabby:tabby:1.0.177
• Tabby » Tabby » Version: 1.0.178
  cpe:2.3:a:tabby:tabby:1.0.178
• Tabby » Tabby » Version: 1.0.179
  cpe:2.3:a:tabby:tabby:1.0.179
• Tabby » Tabby » Version: 1.0.180
  cpe:2.3:a:tabby:tabby:1.0.180
• Tabby » Tabby » Version: 1.0.181
  cpe:2.3:a:tabby:tabby:1.0.181
• Tabby » Tabby » Version: 1.0.182
  cpe:2.3:a:tabby:tabby:1.0.182
• Tabby » Tabby » Version: 1.0.183
  cpe:2.3:a:tabby:tabby:1.0.183
• Tabby » Tabby » Version: 1.0.184
  cpe:2.3:a:tabby:tabby:1.0.184
• Tabby » Tabby » Version: 1.0.185
  cpe:2.3:a:tabby:tabby:1.0.185
• Tabby » Tabby » Version: 1.0.186
  cpe:2.3:a:tabby:tabby:1.0.186
• Tabby » Tabby » Version: 1.0.187
  cpe:2.3:a:tabby:tabby:1.0.187
• Tabby » Tabby » Version: 1.0.188
  cpe:2.3:a:tabby:tabby:1.0.188
• Tabby » Tabby » Version: 1.0.189
  cpe:2.3:a:tabby:tabby:1.0.189
• Tabby » Tabby » Version: 1.0.190
  cpe:2.3:a:tabby:tabby:1.0.190
• Tabby » Tabby » Version: 1.0.191
  cpe:2.3:a:tabby:tabby:1.0.191
• Tabby » Tabby » Version: 1.0.192
  cpe:2.3:a:tabby:tabby:1.0.192
• Tabby » Tabby » Version: 1.0.193
  cpe:2.3:a:tabby:tabby:1.0.193
• Tabby » Tabby » Version: 1.0.194
  cpe:2.3:a:tabby:tabby:1.0.194
• Tabby » Tabby » Version: 1.0.195
  cpe:2.3:a:tabby:tabby:1.0.195
• Tabby » Tabby » Version: 1.0.196
  cpe:2.3:a:tabby:tabby:1.0.196
• Tabby » Tabby » Version: 1.0.197
  cpe:2.3:a:tabby:tabby:1.0.197
• Tabby » Tabby » Version: 1.0.198
  cpe:2.3:a:tabby:tabby:1.0.198
• Tabby » Tabby » Version: 1.0.199
  cpe:2.3:a:tabby:tabby:1.0.199
• Tabby » Tabby » Version: 1.0.200
  cpe:2.3:a:tabby:tabby:1.0.200
• Tabby » Tabby » Version: 1.0.201
  cpe:2.3:a:tabby:tabby:1.0.201
• Tabby » Tabby » Version: 1.0.202
  cpe:2.3:a:tabby:tabby:1.0.202
• Tabby » Tabby » Version: 1.0.203
  cpe:2.3:a:tabby:tabby:1.0.203
• Tabby » Tabby » Version: 1.0.204
  cpe:2.3:a:tabby:tabby:1.0.204
• Tabby » Tabby » Version: 1.0.205
  cpe:2.3:a:tabby:tabby:1.0.205
• Tabby » Tabby » Version: 1.0.206
  cpe:2.3:a:tabby:tabby:1.0.206
• Tabby » Tabby » Version: 1.0.207
  cpe:2.3:a:tabby:tabby:1.0.207
• Tabby » Tabby » Version: 1.0.208
  cpe:2.3:a:tabby:tabby:1.0.208
• Tabby » Tabby » Version: 1.0.209
  cpe:2.3:a:tabby:tabby:1.0.209
• Tabby » Tabby » Version: 1.0.210
  cpe:2.3:a:tabby:tabby:1.0.210
• Tabby » Tabby » Version: 1.0.211
  cpe:2.3:a:tabby:tabby:1.0.211
• Tabby » Tabby » Version: 1.0.212
  cpe:2.3:a:tabby:tabby:1.0.212
• Tabby » Tabby » Version: 1.0.213
  cpe:2.3:a:tabby:tabby:1.0.213
• Tabby » Tabby » Version: 1.0.214
  cpe:2.3:a:tabby:tabby:1.0.214
• Tabby » Tabby » Version: 1.0.215
  cpe:2.3:a:tabby:tabby:1.0.215
• Tabby » Tabby » Version: 1.0.216
  cpe:2.3:a:tabby:tabby:1.0.216
• Tabby » Tabby » Version: 1.0.217
  cpe:2.3:a:tabby:tabby:1.0.217
• Tabby » Tabby » Version: 1.0.218
  cpe:2.3:a:tabby:tabby:1.0.218
• Tabby » Tabby » Version: 1.0.219
  cpe:2.3:a:tabby:tabby:1.0.219
• Tabby » Tabby » Version: 1.0.220
  cpe:2.3:a:tabby:tabby:1.0.220
• Tabby » Tabby » Version: 1.0.221
  cpe:2.3:a:tabby:tabby:1.0.221
• Tabby » Tabby » Version: 1.0.222
  cpe:2.3:a:tabby:tabby:1.0.222
• Tabby » Tabby » Version: 1.0.223
  cpe:2.3:a:tabby:tabby:1.0.223
• Tabby » Tabby » Version: 1.0.224
  cpe:2.3:a:tabby:tabby:1.0.224
• Tabby » Tabby » Version: 1.0.225
  cpe:2.3:a:tabby:tabby:1.0.225
• Tabby » Tabby » Version: 1.0.226
  cpe:2.3:a:tabby:tabby:1.0.226
• Tabby » Tabby » Version: 1.0.227
  cpe:2.3:a:tabby:tabby:1.0.227
• Tabby » Tabby » Version: 1.0.228
  cpe:2.3:a:tabby:tabby:1.0.228
• Tabby » Tabby » Version: 1.0.229
  cpe:2.3:a:tabby:tabby:1.0.229
• Tabby » Tabby » Version: 1.0.230
  cpe:2.3:a:tabby:tabby:1.0.230
• Tabby » Tabby » Version: 1.0.231
  cpe:2.3:a:tabby:tabby:1.0.231
• Tabby » Tabby » Version: 1.0.232
  cpe:2.3:a:tabby:tabby:1.0.232
• Tabby » Tabby » Version: 1.0.65
  cpe:2.3:a:tabby:tabby:1.0.65
• Tabby » Tabby » Version: 1.0.66
  cpe:2.3:a:tabby:tabby:1.0.66
• Tabby » Tabby » Version: 1.0.67
  cpe:2.3:a:tabby:tabby:1.0.67
• Tabby » Tabby » Version: 1.0.68
  cpe:2.3:a:tabby:tabby:1.0.68
• Tabby » Tabby » Version: 1.0.69
  cpe:2.3:a:tabby:tabby:1.0.69
• Tabby » Tabby » Version: 1.0.70
  cpe:2.3:a:tabby:tabby:1.0.70
• Tabby » Tabby » Version: 1.0.71
  cpe:2.3:a:tabby:tabby:1.0.71
• Tabby » Tabby » Version: 1.0.72
  cpe:2.3:a:tabby:tabby:1.0.72
• Tabby » Tabby » Version: 1.0.73
  cpe:2.3:a:tabby:tabby:1.0.73
• Tabby » Tabby » Version: 1.0.74
  cpe:2.3:a:tabby:tabby:1.0.74
• Tabby » Tabby » Version: 1.0.75
  cpe:2.3:a:tabby:tabby:1.0.75
• Tabby » Tabby » Version: 1.0.76
  cpe:2.3:a:tabby:tabby:1.0.76
• Tabby » Tabby » Version: 1.0.77
  cpe:2.3:a:tabby:tabby:1.0.77
• Tabby » Tabby » Version: 1.0.78
  cpe:2.3:a:tabby:tabby:1.0.78
• Tabby » Tabby » Version: 1.0.79
  cpe:2.3:a:tabby:tabby:1.0.79
• Tabby » Tabby » Version: 1.0.80
  cpe:2.3:a:tabby:tabby:1.0.80
• Tabby » Tabby » Version: 1.0.81
  cpe:2.3:a:tabby:tabby:1.0.81
• Tabby » Tabby » Version: 1.0.82
  cpe:2.3:a:tabby:tabby:1.0.82
• Tabby » Tabby » Version: 1.0.83
  cpe:2.3:a:tabby:tabby:1.0.83
• Tabby » Tabby » Version: 1.0.84
  cpe:2.3:a:tabby:tabby:1.0.84
• Tabby » Tabby » Version: 1.0.85
  cpe:2.3:a:tabby:tabby:1.0.85
• Tabby » Tabby » Version: 1.0.86
  cpe:2.3:a:tabby:tabby:1.0.86
• Tabby » Tabby » Version: 1.0.87
  cpe:2.3:a:tabby:tabby:1.0.87
• Tabby » Tabby » Version: 1.0.88
  cpe:2.3:a:tabby:tabby:1.0.88
• Tabby » Tabby » Version: 1.0.89
  cpe:2.3:a:tabby:tabby:1.0.89
• Tabby » Tabby » Version: 1.0.90
  cpe:2.3:a:tabby:tabby:1.0.90
• Tabby » Tabby » Version: 1.0.91
  cpe:2.3:a:tabby:tabby:1.0.91
• Tabby » Tabby » Version: 1.0.92
  cpe:2.3:a:tabby:tabby:1.0.92
• Tabby » Tabby » Version: 1.0.93
  cpe:2.3:a:tabby:tabby:1.0.93
• Tabby » Tabby » Version: 1.0.94
  cpe:2.3:a:tabby:tabby:1.0.94
• Tabby » Tabby » Version: 1.0.95
  cpe:2.3:a:tabby:tabby:1.0.95
• Tabby » Tabby » Version: 1.0.96
  cpe:2.3:a:tabby:tabby:1.0.96
• Tabby » Tabby » Version: 1.0.97
  cpe:2.3:a:tabby:tabby:1.0.97
• Tabby » Tabby » Version: 1.0.98
  cpe:2.3:a:tabby:tabby:1.0.98
• Tabby » Tabby » Version: 1.0.99
  cpe:2.3:a:tabby:tabby:1.0.99