Tabby terminal emulator versions prior to 1.0.233 are vulnerable to OS command injection, which could allow a local attacker to execute arbitrary commands with the privileges of the application.

This vulnerability is caused by the improper neutralization of special elements used in an OS command (CWE-78), resulting in command injection. The attack requires local access and specific conditions (AC:H) to trigger, but could lead to a total compromise of the application's environment.

Successful command injection grants an attacker the ability to execute arbitrary code on the underlying system, leading to full system compromise. With a CVSS score of 7.0, this vulnerability poses a severe risk to the integrity and availability of the host machine, potentially allowing for data theft, lateral movement, or the installation of persistent backdoors.

Immediate Action: Update the Tabby terminal emulator to version 1.0.233 or the latest available release.

Proactive Monitoring: Monitor system processes for unusual child processes spawned by the Tabby application, particularly those executing shell commands.

Compensating Controls: Apply strict OS-level permissions to the user account running Tabby to limit the potential blast radius of a successful command injection.

Public Exploit Available: No

Given the potential for arbitrary code execution, updating to version 1.0.233 is critical for all users of the Tabby terminal. Administrators should enforce standard security hygiene, such as minimizing user privileges and maintaining up-to-date application software, to mitigate the risk of local exploitation.