Vulnerability · Published Jan 8, 2025 · Assigned by GitHub_M

CVE-2025-22136Tabby has a TCC Bypass via Misconfigured Node Fuses

High 8.6

In plain English

A high-severity code injection in tabby from Eugeny. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.4%top 70.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.217 , Tabby enables several high-risk Electron Fuses, including RunAsNode, EnableNodeCliInspectArguments, and EnableNodeOptionsEnvironmentVariable. These fuses create potential code injection vectors even though the application is signed with hardened runtime and lacks dangerous entitlements such as com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables. This vulnerability is fixed in 1.0.217.

Affected products (as reported)

Vendor	Product	Versions
Eugeny	tabby	< 1.0.217

Weakness: CWE-94 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/Eugeny/tabby/security/advisories/GHSA-prcj-7rvc-26h4 x_refsource_CONFIRM
https://github.com/Eugeny/tabby/commit/93513541f7161fa8a59491603cabb6a101c0c08e x_refsource_MISC