HIGH
Tabby has a TCC Bypass via Misconfigured Node Fuses
Published Jan 8, 2025
8.6
HIGHCVSS 4.0
EPSS 0.36%
Description
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.217 , Tabby enables several high-risk Electron Fuses, including RunAsNode, EnableNodeCliInspectArguments, and EnableNodeOptionsEnvironmentVariable. These fuses create potential code injection vectors even though the application is signed with hardened runtime and lacks dangerous entitlements such as com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables. This vulnerability is fixed in 1.0.217.
Affected products
-
- Version < 1.0.217StatusaffectedConstraints-
- Version
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (2)
- https://github.com/Eugeny/tabby/commit/93513541f7161fa8a59491603cabb6a101c0c08e x_refsource_MISC
- https://github.com/Eugeny/tabby/security/advisories/GHSA-prcj-7rvc-26h4 x_refsource_CONFIRM
| Link | Providers | Tags |
|---|---|---|
| https://github.com/Eugeny/tabby/commit/93513541f7161fa8a59491603cabb6a101c0c08e | x_refsource_MISC | |
| https://github.com/Eugeny/tabby/security/advisories/GHSA-prcj-7rvc-26h4 | x_refsource_CONFIRM |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published Jan 8, 2025
Updated Jan 8, 2025
Reserved Dec 30, 2024
Link CVE-2025-22136
CISA Vulnrichment
Updated Jan 8, 2025