CVE-2026-53534 JabRef CAYW Sublime Text integration permits operating-system command injection
Attackers can execute arbitrary OS commands via the built-in HTTP server if enabled, requiring user interaction and specific configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-53534?
CVE-2026-53534 is a high-severity command injection vulnerability in jabref, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand() passes it through CAYWResource.getCitation() into PushToSublimeText.getCommandLine(). On Unix-like systems, PushToSublimeText combines this untrusted cite-command prefix and citation keys into a string executed through sh -c by ProcessBuilder without shell escaping. A client that can cause a localhost request with application=sublime can inject shell metacharacters and execute operating-system commands as the JabRef user when a valid Sublime Text command path is configured and the victim completes the CAYW selection dialog. The built-in server is disabled by default, so exploitation requires the victim to enable it or run jabsrv. This issue is fixed in version 6.0-alpha.6.
Weakness: CWE-78
Which versions are affected by CVE-2026-53534?
How do I fix CVE-2026-53534?
No fix has been published for CVE-2026-53534 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-53534 being exploited?
There is no known exploitation of CVE-2026-53534 in the wild and no public exploit code.
Sources
Also known as GHSA-m42c-cw93-p629, UBUNTU-CVE-2026-53534.