CVE-2026-82605 BareBones BBEdit Lasso Language Tokenizer infinite loop
Remote attackers can cause a denial of service via an infinite loop in the Lasso Language Tokenizer of BBEdit.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-82605?
CVE-2026-82605 is a medium-severity denial of service vulnerability in BareBones BBEdit, published on 31 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability has been found in BareBones BBEdit up to 15.5.5. The affected element is an unknown function of the component Lasso Language Tokenizer. Such manipulation leads to infinite loop. The attack can be executed remotely. Upgrading to version 16.0 is sufficient to fix this issue. The affected component should be upgraded.
Which versions are affected by CVE-2026-82605?
How do I fix CVE-2026-82605?
No fix has been published for CVE-2026-82605 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-82605 being exploited?
There is no known exploitation of CVE-2026-82605 in the wild and no public exploit code.
Sources
Also known as GHSA-hcgm-vv9f-xh79.