Executive brief
JabRef is a bibliography management desktop application that can optionally run a built-in HTTP server. When enabled, the server's CAYW endpoint accepts untrusted user input and passes it directly to shell commands without proper escaping. An attacker on the local network can inject shell commands that execute with the privileges of the JabRef user if the victim has configured Sublime Text integration and completes a dialog interaction.
Technical details
This is a shell injection vulnerability in the CAYW (Citation And Your Way) endpoint of JabRef's optional HTTP server. The vulnerability exists in the GET /better-bibtex/cayw endpoint, which accepts a command query parameter that is passed unsanitized through CAYWQueryParams.getCommand() and CAYWResource.getCitation() to PushToSublimeText.getCommandLine(). On Unix-like systems, the untrusted cite-command prefix and citation keys are concatenated into a single string and executed via ProcessBuilder with "sh -c" without shell metacharacter escaping. Exploitation requires: (1) the built-in HTTP server or jabsrv to be enabled (disabled by default), (2) a localhost request with application=sublime, (3) a valid Sublime Text command path configured, and (4) the user completing the CAYW selection dialog. An attacker can inject shell metacharacters to execute arbitrary OS commands. The vulnerability was fixed in version 6.0-alpha.6.
Affected products
- JabRef JabRef prior to 6.0-alpha.6
Timeline
- 2026-09-17: disclosed: CVE-2026-53534 published
- 2026-05-03: patched: Fix merged in commit b8663fe