CVE-2026-53534

JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand passes it through...

CVE-2026-53534

JabRef , a desktop BibTeX/BibLaTeX manager, is affected by an operating-system command injection in its CAYW (Cite-As-You-Write) Sublime Text integration prior to 6.0-alpha.6 . When JabRef's built-in HTTP server or jabsrv is enabled, the GET /better-bibtex/cayw endpoint accepts an external comman...

CVE-2026-53534 JabRef CAYW Sublime Text integration permits operating-system command injection

JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand passes it through...

EUVD-2026-82565

JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand passes it through...