Get real-time updates on Telegram
P5Verified
Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)
CVE-2026-46709. EPSS 0.00252 (percentile 0.1518), scored 2026-10-03. Fixed version: ecf2a487bcfdbdd43a324dc4b168e522b0d65130. Fixed version: e151472b951bbd472ddc0545ec8656e4c0f352da. Fixed version: 9c579c0f0f1b3893674d4b2d7705b766f7e1fd88.
- CVE
- CVE-2026-46709
- CCR priority
- 0.1 /100 (P5)
- CVSS
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · OSV.dev
- EPSS
- 0.00252 · percentile 0.1518 · 2026-10-03
- KEV
- no
Affected products
- Fixed version: ecf2a487bcfdbdd43a324dc4b168e522b0d65130
- Fixed version: e151472b951bbd472ddc0545ec8656e4c0f352da
- Fixed version: 9c579c0f0f1b3893674d4b2d7705b766f7e1fd88
Provenance
- OSV.dev · Source record · observed 2026-10-04 13:35:46.972631+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-46709.html