CVE-2026-53534
Description
A flaw was found in JabRef, a desktop application for managing BibTeX and BibLaTeX libraries. When the built-in HTTP server or jabsrv is enabled, a client can inject shell metacharacters into the command query parameter of the /better-bibtex/cayw endpoint. This allows for the execution of arbitrary operating-system commands as the JabRef user. Exploitation requires a valid Sublime Text command path to be configured and the victim to complete a CAYW selection dialog.
Statement
This vulnerability is rated as Moderate impact because successful command execution requires an uncommon non-default service configuration along with interactive user confirmation. The integrated web service is turned off by default, and triggering the flaw necessitates external Sublime Text binary integration to be configured on the host system. Furthermore, JabRef is not included or supported within Red Hat Enterprise Linux or any other Red Hat product offerings.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
