Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-53534— JabRef CAYW Sublime Text integration permits operating-system command injection

Quick assessment

Affected
JabRef jabref
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

JabRef 是一款用于管理 BibTeX 和 BibLaTeX 文献库的桌面应用程序。在 6.0-alpha.6 之前的版本中，当启用 jabsrv 或 JabRef 内置的 HTTP 服务器时， 端点接受一个名为“外部命令”的查询参数，而 会通过 将该参数传递至 。 类 Unix 系统上， 会将这个不可信的 前缀与引文键组合成一个字符串，并通过 以 方式执行，且未进行 shell 转义。能够向 发起携带 的请求的客户端，可以在配置了有效的 Sublime Text 命令路径，并且受害者完成了 CAYW 选择对话

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53534

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
JabRef CAYW Sublime Text integration permits operating-system command injection
Source: CVE Program / CVE List V5
Vulnerability Description
JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand() passes it through CAYWResource.getCitation() into PushToSublimeText.getCommandLine(). On Unix-like systems, PushToSublimeText combines this untrusted cite-command prefix and citation keys into a string executed through sh -c by ProcessBuilder without shell escaping. A client that can cause a localhost request with application=sublime can inject shell metacharacters and execute operating-system commands as the JabRef user when a valid Sublime Text command path is configured and the victim completes the CAYW selection dialog. The built-in server is disabled by default, so exploitation requires the victim to enable it or run jabsrv. This issue is fixed in version 6.0-alpha.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
JabRef jabref < 6.0-alpha.6 -

II. Public POCs for CVE-2026-53534

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53534

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53534 (1)

Vendor Advisories for CVE-2026-53534 (1)

Vendor Pages for CVE-2026-53534 (1)

IV. Related Vulnerabilities

Same weakness: CWE-78

V. Comments for CVE-2026-53534

No comments yet

Leave a comment