CVE-2025-22136: Tabby has a TCC Bypass via Misconfigured Node Fuses
Description
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.217 , Tabby enables several high-risk Electron Fuses, including RunAsNode, EnableNodeCliInspectArguments, and EnableNodeOptionsEnvironmentVariable. These fuses create potential code injection vectors even though the application is signed with hardened runtime and lacks dangerous entitlements such as com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables. This vulnerability is fixed in 1.0.217.
Classification
CVE ID: CVE-2025-22136
CVSS Base Severity: HIGH
CVSS Base Score: 8.6
Affected Products
Vendor: Eugeny
Product: tabby
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 11.48% (scored less or equal to compared to others)
EPSS Date: 2025-02-06 (when was this score calculated)
References
https://github.com/Eugeny/tabby/security/advisories/GHSA-prcj-7rvc-26h4https://github.com/Eugeny/tabby/commit/93513541f7161fa8a59491603cabb6a101c0c08e