From ed3fbff5e818708b17fe5ef188d7a71f35540d2a Mon Sep 17 00:00:00 2001
From: Sebastion <sebastion@sebastion.dev>
Date: Thu, 7 May 2026 21:15:48 +0100
Subject: [PATCH] fix(configSync): require HTTPS for sync host to prevent MITM
 RCE (#11228)

---
 tabby-settings/src/services/configSync.service.ts | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/tabby-settings/src/services/configSync.service.ts b/tabby-settings/src/services/configSync.service.ts
index 4fc32e51..9f8cfd06 100644
--- a/tabby-settings/src/services/configSync.service.ts
+++ b/tabby-settings/src/services/configSync.service.ts
@@ -163,7 +163,18 @@ export class ConfigSyncService {
         if (this.config.store.configSync.host.endsWith('/')) {
             this.config.store.configSync.host = this.config.store.configSync.host.slice(0, -1)
         }
-        url = this.config.store.configSync.host + url
+        const host: string = this.config.store.configSync.host
+        // Refuse to sync configuration over a plaintext channel. The remote
+        // payload is parsed as YAML and merged into the local config (including
+        // profiles whose `command`/`env` are later executed by the terminal),
+        // so a network attacker able to MITM cleartext HTTP could achieve
+        // arbitrary command execution on the next sync. Require HTTPS.
+        if (!/^https:\/\//i.test(host)) {
+            const message = `Config sync host must use HTTPS (got: ${host})`
+            this.logger.error(message)
+            throw new Error(message)
+        }
+        url = host + url
         this.logger.debug(`${method} ${url}`, params)
         try {
             const response = await axios.request({