Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command… (CVE-2026-53534)
JabRef versions prior to 6.0-alpha.6 have a vulnerability in the built-in HTTP server or jabsrv when enabled. The GET /better-bibtex/cayw endpoint improperly handles an external command parameter, allowing shell command injection on Unix-like systems if a valid Sublime Text command path is configured and the user completes the CAYW selection dialog. The built-in server is disabled by default, so exploitation requires explicit enabling. This issue is fixed in version 6.0-alpha.6.
AI Analysis
Technical Summary
JabRef before 6.0-alpha.6 includes a command injection vulnerability in its built-in HTTP server or jabsrv when enabled. The GET /better-bibtex/cayw endpoint accepts an external command query parameter that is passed without shell escaping to a shell command executed via ProcessBuilder on Unix-like systems. This allows an attacker who can cause a localhost request with application=sublime to inject shell metacharacters and execute arbitrary OS commands as the JabRef user, contingent on a valid Sublime Text command path and user interaction completing the CAYW selection dialog. The built-in HTTP server is disabled by default, limiting exposure. The vulnerability is resolved in version 6.0-alpha.6.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary operating system commands with the privileges of the JabRef user on Unix-like systems. This requires the built-in HTTP server or jabsrv to be enabled, a valid Sublime Text command path configured, and user interaction to complete the CAYW selection dialog. The vulnerability could lead to unauthorized command execution and potential system compromise within the context of the JabRef user.
Mitigation Recommendations
Upgrade JabRef to version 6.0-alpha.6 or later, where this vulnerability is fixed. If upgrading is not immediately possible, ensure the built-in HTTP server or jabsrv is disabled (default state) to prevent exposure. No other mitigations are specified.
Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command… (CVE-2026-53534)
Description
JabRef versions prior to 6.0-alpha.6 have a vulnerability in the built-in HTTP server or jabsrv when enabled. The GET /better-bibtex/cayw endpoint improperly handles an external command parameter, allowing shell command injection on Unix-like systems if a valid Sublime Text command path is configured and the user completes the CAYW selection dialog. The built-in server is disabled by default, so exploitation requires explicit enabling. This issue is fixed in version 6.0-alpha.6.
CVSS v4.0
Affected software
pkg:deb/ubuntu/jabref?arch=source&distro=xenialpkg:deb/ubuntu/jabref?arch=source&distro=bionicpkg:deb/ubuntu/jabref?arch=source&distro=focalpkg:deb/ubuntu/jabref?arch=source&distro=jammypkg:deb/ubuntu/jabref?arch=source&distro=noblepkg:deb/ubuntu/jabref?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
JabRef before 6.0-alpha.6 includes a command injection vulnerability in its built-in HTTP server or jabsrv when enabled. The GET /better-bibtex/cayw endpoint accepts an external command query parameter that is passed without shell escaping to a shell command executed via ProcessBuilder on Unix-like systems. This allows an attacker who can cause a localhost request with application=sublime to inject shell metacharacters and execute arbitrary OS commands as the JabRef user, contingent on a valid Sublime Text command path and user interaction completing the CAYW selection dialog. The built-in HTTP server is disabled by default, limiting exposure. The vulnerability is resolved in version 6.0-alpha.6.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary operating system commands with the privileges of the JabRef user on Unix-like systems. This requires the built-in HTTP server or jabsrv to be enabled, a valid Sublime Text command path configured, and user interaction to complete the CAYW selection dialog. The vulnerability could lead to unauthorized command execution and potential system compromise within the context of the JabRef user.
Mitigation Recommendations
Upgrade JabRef to version 6.0-alpha.6 or later, where this vulnerability is fixed. If upgrading is not immediately possible, ensure the built-in HTTP server or jabsrv is disabled (default state) to prevent exposure. No other mitigations are specified.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-53534
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:16.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Cvss Version
- 4.0
Threat ID: 6ab4be64f7a7c54106f0d3bb
Added to database: 09/24/2026, 06:08:36 UTC
Last enriched: 09/24/2026, 06:51:16 UTC
Last updated: 09/25/2026, 01:47:43 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.