CVE-2026-53534

Name of the Vulnerable Software and Affected Versions JabRef versions prior to 6.0-alpha.6

Description JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. When the built-in HTTP server or jabsrv is enabled, the 'GET /better-bibtex/cayw' endpoint accepts an external command query parameter. The CAYWQueryParams.getCommand() function passes this parameter through CAYWResource.getCitation() into PushToSublimeText.getCommandLine(). On Unix-like systems, PushToSublimeText combines this untrusted cite-command prefix and citation keys into a string executed via sh -c by ProcessBuilder without shell escaping. An attacker capable of triggering a localhost request with application=sublime can inject shell metacharacters to execute operating-system commands as the JabRef user, provided a valid Sublime Text command path is configured and the user completes the CAYW selection dialog.

Recommendations Update to version 6.0-alpha.6. Disable the built-in HTTP server or stop running jabsrv to prevent exploitation.