Command Injection Vulnerability in JabRef Desktop Application

CVE-2026-53534

What is CVE-2026-53534?

A command injection vulnerability exists in JabRef, a desktop application designed for managing BibTeX and BibLaTeX libraries. When the built-in HTTP server is enabled in versions before 6.0-alpha.6, an external command can be injected through the GET /better-bibtex/cayw endpoint. This occurs because the application improperly handles user-supplied input, allowing crafted requests to execute arbitrary operating system commands. Specifically, the PushToSublimeText module concatenates unvalidated command prefixes with citation keys, leading to potential exploitation on Unix-like systems via ProcessBuilder. To mitigate risks, users must remain vigilant about keeping their application updated and avoid enabling the built-in server unless necessary.

References