Unvalidated Protocol Handler Execution in Terminal Linkifier

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's terminal linkifier passes any detected URI directly to the operating system's protocol handler without validating the protocol scheme. This allows a malicious SSH or Telnet server to send crafted terminal output containing dangerous protocol URIs which Tabby renders as clickable links, triggering arbitrary OS protocol handlers on the victim's machine. This vulnerability is fixed in 1.0.232.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Tabby terminal emulator versions prior to 1.0.232 contain a critical vulnerability where the linkifier component fails to validate URI protocol schemes before passing them to the operating system's handler. An attacker controlling a malicious SSH or Telnet server can inject crafted terminal output containing dangerous protocol URIs (such as file://, vbscript://, or custom protocol handlers). When a user clicks these rendered links, arbitrary OS protocol handlers execute on their machine, potentially leading to code execution, data exfiltration, or lateral movement. This affects security practitioners, developers, and system administrators who regularly interact with remote systems via Tabby, making it a supply-chain style attack vector originating from compromised or attacker-controlled servers.

Casky's 301 mapped skills leverage Claude's extended reasoning to detect the attack patterns associated with MITRE TA0001 (Reconnaissance) and TA0043 (Reconnaissance for Initial Access). Practitioners using Casky would identify detection signals including: unusual terminal output patterns containing embedded protocol schemes (especially non-standard handlers), correlation between clickable link rendering and subsequent OS process execution, anomalous network connections triggered after link interaction, and behavioral indicators of protocol handler abuse (CWE-601 Open Redirect). The platform's skills map input validation gaps (CWE-184) and insecure protocol handling, enabling practitioners to spot similar vulnerability patterns across their terminal applications, SSH clients, and protocol handlers before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-45037.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-45037

Casky has 301 skills that investigate the attack patterns behind CVE-2026-45037. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn