The Tabby terminal emulator before version 1.0.232 contains an open redirect vulnerability that can be exploited to facilitate phishing or malicious site redirection.

This issue involves an Incomplete List of Disallowed Inputs (CWE-184) leading to an Open Redirect (CWE-601). The vulnerability is exploitable by an unauthenticated attacker, though it requires user interaction (UI:R).

The ability to perform open redirects can be weaponized to bypass security filters and deceive users into visiting malicious domains. While the CVSS score of 7.1 reflects a high-severity risk, the primary impact is the potential for credential theft or malware delivery through social engineering, which can compromise both user and organizational security.

Immediate Action: Update the Tabby terminal emulator to version 1.0.232 or the latest available release.

Proactive Monitoring: Review web proxy logs or browser history for unexpected redirects originating from the terminal application context.

Compensating Controls: Utilize endpoint protection software and web filtering solutions to block access to known malicious domains and prevent users from navigating to untrusted sites.

Public Exploit Available: No

Users of the Tabby terminal emulator should update their software to version 1.0.232 immediately to eliminate the risk of open redirection. Organizations should educate users on the risks of clicking suspicious links, even when they appear to originate from trusted, locally installed applications.