{"id":"CVE-2026-53534","summary":"JabRef CAYW Sublime Text integration permits operating-system command injection","details":"JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand() passes it through CAYWResource.getCitation() into PushToSublimeText.getCommandLine(). On Unix-like systems, PushToSublimeText combines this untrusted cite-command prefix and citation keys into a string executed through sh -c by ProcessBuilder without shell escaping. A client that can cause a localhost request with application=sublime can inject shell metacharacters and execute operating-system commands as the JabRef user when a valid Sublime Text command path is configured and the victim completes the CAYW selection dialog. The built-in server is disabled by default, so exploitation requires the victim to enable it or run jabsrv. This issue is fixed in version 6.0-alpha.6.","aliases":["GHSA-m42c-cw93-p629"],"modified":"2026-09-19T08:14:20.853084Z","published":"2026-09-17T21:42:47.446Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53534.json"},"references":[{"type":"WEB","url":"https://github.com/JabRef/jabref/releases/tag/v6.0-alpha.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53534.json"},{"type":"ADVISORY","url":"https://github.com/JabRef/jabref/security/advisories/GHSA-m42c-cw93-p629"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53534"},{"type":"FIX","url":"https://github.com/JabRef/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2"},{"type":"FIX","url":"https://github.com/JabRef/jabref/pull/15628"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jabref/jabref","events":[{"introduced":"0"},{"fixed":"b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2"},{"fixed":"6d24100549695468c0499d7cd817a8eb1692d720"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"6.0-alpha.6"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v6.0-alpha.5","v6.0-alpha.4","v6.0-alpha.3","v6.0-alpha2","v6.0-alpha","v5.15","v5.14","v5.13","v5.12","v5.11","v5.10","v5.9","v5.8","v5.7","v5.6","v5.5","v5.4","v5.3","v5.2","v5.1","v5.0","v5.0-beta","v5.0-alpha","v4.3","v4.2","v4.1","v4.0","v4.0-beta3","v4.0-beta2","v4.0-beta","v3.5","v3.4","v3.3","v3.2","v3.1","v3.0","v_2.11b3","v_2.11b2","v_2.11b","v_2.10","v_2.10b3","v_2.10b2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53534.json","vanir_signatures_modified":"2026-09-19T08:14:20Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["11738649890648111948646063958495324034","197168096351006517186115320741111719057","156946420283217365252537052240690298892","143538793057130260601859218746640469296","185540445609846095520786878375577100907","222339125647324931170318326631178400249","26274879494035163474676150767703322950","147420823394361005897563744831680657357","337114468069796811912957679348629393921","228922568170286308980481193253498476331","216408538955451142328033392274874536023","169485145789427790818528399594357639308","160539346816777999200735802223663334829","101112604188761789763233933514742635923","264530661336642747986042155163933869430","147877336080744098315917110389579109111","245043343799274195004920677230165162226","57422263235434590515045241750392427940","59015500389471837041038905899052443918","105863045948043030877630314016324090130","238382866306807960960276879029410709103","243077979490241498992979285032049004168","308670722837562377764934545437690085090","227844036395181515360167391951898475259","84024166758372108206024874585056392722","259883883648242146192118672313648211912","79729046199164932992977718367161036398","201931952282552815839172353408517663636","44129487902143717022613983661368552270","161514256329457173745399981174351516949","11019854003497768576087409867881713697","75622821651630043160288329989306467713","86713902544215155434307305413431974947","313854939257284936268439714283748407158","95559265716538390835964193721554145344"],"threshold":0.9},"id":"CVE-2026-53534-026afa08","signature_type":"Line","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToEmacs.java"}},{"deprecated":false,"digest":{"line_hashes":["170097076382184849690472852634339771505","51429909377118046662906232973064918323","275410037581892794491153498708727678861","87104358080770394652839939336281028250","69438682714949640186740307527375030749","67398750253671090366190320161294243209","273882140512582769275253981269012854925"],"threshold":0.9},"id":"CVE-2026-53534-0a028a7b","signature_type":"Line","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToLyx.java"}},{"id":"CVE-2026-53534-0bc1a760","signature_type":"Line","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToTeXstudio.java"},"deprecated":false,"digest":{"line_hashes":["170097076382184849690472852634339771505","246505433618330527014851102203756163741","61030528599530946878312958954389872603","171940566999599508308704418803474012320","69438682714949640186740307527375030749","67398750253671090366190320161294243209","273882140512582769275253981269012854925"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToWinEdt.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["243738285177310295791484728013984052964","259589232845146509230696225362263363506","129369210989805020700927486897428067399","273244309356143636667120822416111133663","295182455456892821989515803427824765720","21517482807549661651533970207123335274"]},"id":"CVE-2026-53534-0df6a7fb","signature_type":"Line"},{"target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToEmacs.java"},"deprecated":false,"digest":{"line_hashes":["170097076382184849690472852634339771505","51429909377118046662906232973064918323","275410037581892794491153498708727678861","87104358080770394652839939336281028250","69438682714949640186740307527375030749","67398750253671090366190320161294243209","273882140512582769275253981269012854925"],"threshold":0.9},"id":"CVE-2026-53534-1a95d85c","signature_type":"Line","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2"},{"digest":{"line_hashes":["170097076382184849690472852634339771505","51429909377118046662906232973064918323","275410037581892794491153498708727678861","87104358080770394652839939336281028250","69438682714949640186740307527375030749","67398750253671090366190320161294243209","273882140512582769275253981269012854925"],"threshold":0.9},"id":"CVE-2026-53534-204a1209","signature_type":"Line","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToVim.java"},"deprecated":false},{"id":"CVE-2026-53534-2214a9fd","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToLyx.java","function":"sendErrorNotification"},"deprecated":false,"digest":{"function_hash":"278757463650687339901441830253567878007","length":93}},{"id":"CVE-2026-53534-29810ac5","signature_type":"Line","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabsrv/src/test/java/org/jabref/http/server/cayw/CAYWResourceTest.java"},"deprecated":false,"digest":{"line_hashes":["16348589303532722291746176337883278","142987962738759142186566021076488480931"],"threshold":0.9}},{"source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToLyx.java","function":"pushEntries"},"deprecated":false,"digest":{"function_hash":"298035160414197153269197283073586777999","length":992},"id":"CVE-2026-53534-31314779","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"215669189115833037010496875223397414545","length":292},"id":"CVE-2026-53534-342341d8","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/test/java/org/jabref/gui/push/PushToTeXworksTest.java","function":"pushEntries"}},{"deprecated":false,"digest":{"function_hash":"131584086475151966305801821094619251569","length":662},"id":"CVE-2026-53534-36af71df","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/AbstractPushToApplication.java","function":"onOperationCompleted"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/AbstractPushToApplication.java"},"deprecated":false,"digest":{"line_hashes":["195412797108280837704772402501462184220","213463429485867829360680614588704606828","75928610343376904616829200304554181838","14847533060384911589277148251747409649","153976844653366762081009909631828432979","100549115590273928691710527989143955393","222114412914055601864671703976850288595","222339125647324931170318326631178400249","266750641818375692240658185626740416716","156628825842125225263678796249380752983","260788784886676555135547947287019215735","279715450091514268524198255227626768703","238459846716571796118652915674159801651","36548322529987336282087810557495691719","287238031241702173094701269780619729140","110352735232872876564767278320989356781","104342379498061847230602529692502439657","9079867555399374394584028781924823558","267932987718056352759735478609651558995","286340974469666409483790509426589776160","165746065515203274801304168511373086521","67166422802442112275460800594703828275","282690997664070899492950344796138756113","165065667587450138429788743926478025480","199802198300924297887377684206896557240","131999989739761441285599077186330569512","108592341240473393139530129249128391548","11293261933042149802791164017627298275","174265778183900686444380009518278318586","211033126914466677278092001048301917667","235560643060724828293711214828773576507","228592633208969680238634045261675963829","43134763012368075088028977884237859006","21631960376315084270951273179916478777","177475016433751158833256686081773623628","84424303660123597888548593891028012535","279560501835142983034415002249512468664","194387710463427874374448154148999393009","53928932622641324400953316632404383937","206608091612954792328697461914489688537","223765814600850473788546451421843305957","269528006582222182803333377815202314656","35484812046498476075117605256494944812","1417220583367458761933751171703472167","260788784886676555135547947287019215735"],"threshold":0.9},"id":"CVE-2026-53534-3a5790fc"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/test/java/org/jabref/gui/push/PushToTeXworksTest.java","function":"getCommandLine"},"deprecated":false,"digest":{"function_hash":"286954278940420158863245566335946277147","length":176},"id":"CVE-2026-53534-3c8c1848"},{"id":"CVE-2026-53534-3d7cc33f","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToSublimeText.java","function":"pushEntries"},"deprecated":false,"digest":{"function_hash":"265319644520430585963546989104501495438","length":1015}},{"deprecated":false,"digest":{"function_hash":"262122538066916185976360459822329624646","length":190},"id":"CVE-2026-53534-41ed1eb0","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToVim.java","function":"jumpToLineCommandlineArguments"}},{"source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToTexmaker.java"},"deprecated":false,"digest":{"line_hashes":["170097076382184849690472852634339771505","246505433618330527014851102203756163741","61128527144723598830061726705351552811","132962967688296059875494376809728808901","69438682714949640186740307527375030749","67398750253671090366190320161294243209","273882140512582769275253981269012854925"],"threshold":0.9},"id":"CVE-2026-53534-491b7134","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"243684408234991826683040787549193390899","length":691},"id":"CVE-2026-53534-4ba7a16a","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToTexShop.java","function":"getCommandLine"}},{"signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToVim.java","function":"pushEntries"},"deprecated":false,"digest":{"length":1142,"function_hash":"59629344022899340821229176802997889844"},"id":"CVE-2026-53534-4f3ce4f8","signature_type":"Function"},{"target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToVim.java","function":"jumpToLine"},"deprecated":false,"digest":{"function_hash":"207671887350100842102847018681279043074","length":865},"id":"CVE-2026-53534-58276bb2","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2"},{"digest":{"line_hashes":["170097076382184849690472852634339771505","246505433618330527014851102203756163741","59305494354003629866086527941671395517","111294017578464149713790910794502117098","69438682714949640186740307527375030749","67398750253671090366190320161294243209","273882140512582769275253981269012854925"],"threshold":0.9},"id":"CVE-2026-53534-5e15c08b","signature_type":"Line","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToVScode.java"},"deprecated":false},{"target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToSublimeText.java"},"deprecated":false,"digest":{"line_hashes":["170097076382184849690472852634339771505","246505433618330527014851102203756163741","329885719149279908677308636854757764137","246064459426628036684121660820888902063","69438682714949640186740307527375030749","67398750253671090366190320161294243209","273882140512582769275253981269012854925"],"threshold":0.9},"id":"CVE-2026-53534-6681bb5b","signature_type":"Line","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToEmacs.java","function":"onOperationCompleted"},"deprecated":false,"digest":{"length":393,"function_hash":"123762459297931126178001329495309862177"},"id":"CVE-2026-53534-6d69040d"},{"target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToSublimeText.java"},"deprecated":false,"digest":{"line_hashes":["149228805980029640898318463502174184195","222255444502300511917360372447155042654","228490993468969159933969646584397096696","222339125647324931170318326631178400249","266750641818375692240658185626740416716","156628825842125225263678796249380752983","260788784886676555135547947287019215735","43391874647741980859531936120535453298","63774564344056273149494632222793364793","168835653730514576804877714520296106392","205408620071132351726384221687134513004","158586488401357781931165828733307997376","202971717279531084842266591029699382688","12818020109035118311392030548640399915","198032042059900135910865154119861582965","213990462666394392372075950482582711320","36295865876173629742483704850922222349","44082156144099813522406555343977582670","9492660327646341262069536886124492556","247079771832548668324102502536849198426","15039142898271747683264554747949440463","45620787297709886567892838471153046952","249439466545137340903766859312004495330","171626645666346421886336523088261631641","42200235798094563884111045805148503502","201931952282552815839172353408517663636","42998666441684470199660296952051302993","55899291074326367441168177650941910659","309307860289889964319136937527228250215","64701623207865379458075811156332238377","44042700659994415110938392416528180277","126212785445268549413907189345946523851","306001137066924218355900977157504433024","24132217767311798270178264859690619721","140414244408935997220361494582350336247","296004788866619637186763378284816105972"],"threshold":0.9},"id":"CVE-2026-53534-7d6d3012","signature_type":"Line","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2"},{"digest":{"function_hash":"40541735523947437135398384928187280796","length":849},"id":"CVE-2026-53534-7ea4d74f","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/AbstractPushToApplication.java","function":"pushEntries"},"deprecated":false},{"target":{"file":"jablib/src/main/java/org/jabref/logic/push/CitationCommandString.java"},"deprecated":false,"digest":{"line_hashes":["127182126879966292779169787060200443686","61948974344691389028931573669879398383","841896310471024738242024584851653429","219495840929811375677178406074730449163","178129091092767635305164795886062889160"],"threshold":0.9},"id":"CVE-2026-53534-845a7961","signature_type":"Line","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2"},{"source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/test/java/org/jabref/gui/push/PushToTeXworksTest.java"},"deprecated":false,"digest":{"line_hashes":["316007367462411469571681814757302264222","96747194673797430752083944685743371454","116268333148848490977496588383878771346","330764606207052077247239758493987562267","337170409152136279520359769370717497948","5819706179935855748119734205181858793","140793942382066641655680167495884093694","331626214315369676284312072114588800010","98210697223665462512240866198458358311","259996288000071935760835823727414474255","223100316831335809054824424973974181454","111970625247460966470621461367358470393","203686972339844877065042201243438592250","117869552132283202714072521262193439153"],"threshold":0.9},"id":"CVE-2026-53534-875c1391","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"176800736800395396612597381446307949836","length":499},"id":"CVE-2026-53534-9082614c","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/AbstractPushToApplication.java","function":"jumpToLine"}},{"source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToLyx.java"},"deprecated":false,"digest":{"line_hashes":["148736079884954535819144030245369307441","92852344256470886757044847559358844727","156946420283217365252537052240690298892","143538793057130260601859218746640469296","185540445609846095520786878375577100907","222339125647324931170318326631178400249","26274879494035163474676150767703322950","147420823394361005897563744831680657357","337114468069796811912957679348629393921","228922568170286308980481193253498476331"],"threshold":0.9},"id":"CVE-2026-53534-96ecebab","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToWinEdt.java"},"deprecated":false,"digest":{"line_hashes":["170097076382184849690472852634339771505","246505433618330527014851102203756163741","283333683058941575924272302434835096408","197818026612307423424417379105458166646","69438682714949640186740307527375030749","67398750253671090366190320161294243209","273882140512582769275253981269012854925"],"threshold":0.9},"id":"CVE-2026-53534-985f99d4","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["170097076382184849690472852634339771505","246505433618330527014851102203756163741","17168468040655293903327024812661068695","228389888428649345052186654308311198068","69438682714949640186740307527375030749","67398750253671090366190320161294243209","273882140512582769275253981269012854925"],"threshold":0.9},"id":"CVE-2026-53534-9bf8472f","signature_type":"Line","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToTeXworks.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToTexShop.java"},"deprecated":false,"digest":{"line_hashes":["222339125647324931170318326631178400249","47892718144661618692746055336034090181","79148786263301128059475531264996928597","201830758531124676437525561449440722061","111259317253041655754279986397162214044","158433057710196799818319637714457239848","97303299593329557654110139610362496237","256850062859772700679680331398739268992","308045489802079304617952255628352330781","9492660327646341262069536886124492556","247079771832548668324102502536849198426","15039142898271747683264554747949440463","45620787297709886567892838471153046952","249439466545137340903766859312004495330","171626645666346421886336523088261631641","42200235798094563884111045805148503502","201931952282552815839172353408517663636","186571175495905902106717323853478511101","307265400548902911650213006402823021143","322297986519003628844415145065790416848","155044381644359015291310246342230323620","117248848676463086916800138792944933684","279854266735352286369004453771208396798","116180617498450676010586612347436934074","296574765342859435237408870435578752069","328726311023453345662993425051255890187","244762396287967830656363099846508384501","221787521795926852280136608647645309896","82662530264427797989650421295311409459","100666462151711445889358156247550742341","246272815559739908145605384252247969575","275537818722515664054443316650635532212","98439014766388012616602913104709610399","196363718740459053386774709444577392223","271834745622319258512957767809842833731","290179026059174610379693911037502741575","24732658451842818156731738963073296031","3583108802881146704279750078143437669"],"threshold":0.9},"id":"CVE-2026-53534-9ccde398"},{"digest":{"function_hash":"278757463650687339901441830253567878007","length":93},"id":"CVE-2026-53534-9ec5485f","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToVim.java","function":"sendErrorNotification"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToSublimeText.java","function":"sendErrorNotification"},"deprecated":false,"digest":{"function_hash":"278757463650687339901441830253567878007","length":93},"id":"CVE-2026-53534-a342efbc"},{"deprecated":false,"digest":{"line_hashes":["247349452504920336423305692384237326079","325062770340356500172923730450928327264","258418431859722597041029242099117079623"],"threshold":0.9},"id":"CVE-2026-53534-a469e997","signature_type":"Line","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToTeXworks.java"}},{"signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToTeXstudio.java","function":"sendErrorNotification"},"deprecated":false,"digest":{"function_hash":"278757463650687339901441830253567878007","length":93},"id":"CVE-2026-53534-a9897129","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"54499789525988315001254082961803334558","length":1974},"id":"CVE-2026-53534-b373ecff","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToEmacs.java","function":"pushEntries"}},{"target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToSublimeText.java","function":"getCommandLine"},"deprecated":false,"digest":{"function_hash":"328217384732799666425797951246837853509","length":477},"id":"CVE-2026-53534-b5ee61dd","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2"},{"deprecated":false,"digest":{"length":161,"function_hash":"100958567617523180480708179477543113943"},"id":"CVE-2026-53534-c1579a03","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToWinEdt.java","function":"getCommandLine"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToWinEdt.java","function":"sendErrorNotification"},"deprecated":false,"digest":{"function_hash":"278757463650687339901441830253567878007","length":93},"id":"CVE-2026-53534-c8b31900"},{"source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToTexmaker.java","function":"sendErrorNotification"},"deprecated":false,"digest":{"length":93,"function_hash":"278757463650687339901441830253567878007"},"id":"CVE-2026-53534-d1f5ccd3","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"278757463650687339901441830253567878007","length":93},"id":"CVE-2026-53534-d47c1870","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToTeXworks.java","function":"sendErrorNotification"}},{"deprecated":false,"digest":{"function_hash":"23090182154992913568564188197638542438","length":2365},"id":"CVE-2026-53534-d5d82f75","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabsrv/src/main/java/org/jabref/http/server/cayw/CAYWResource.java","function":"getCitation"}},{"digest":{"function_hash":"278757463650687339901441830253567878007","length":93},"id":"CVE-2026-53534-d71bb780","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToEmacs.java","function":"sendErrorNotification"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToVScode.java","function":"sendErrorNotification"},"deprecated":false,"digest":{"function_hash":"278757463650687339901441830253567878007","length":93},"id":"CVE-2026-53534-d7e443f1"},{"signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/AbstractPushToApplication.java","function":"getCommandName"},"deprecated":false,"digest":{"length":36,"function_hash":"321892578485842126786336907461432498760"},"id":"CVE-2026-53534-d9fba862","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToTexShop.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["170097076382184849690472852634339771505","246505433618330527014851102203756163741","304615688290158571520869045251604877534","203586240565375715754283234581714517906","69438682714949640186740307527375030749","67398750253671090366190320161294243209","273882140512582769275253981269012854925"]},"id":"CVE-2026-53534-e2181ec1","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["11738649890648111948646063958495324034","197168096351006517186115320741111719057","156946420283217365252537052240690298892","143538793057130260601859218746640469296","264530661336642747986042155163933869430","147877336080744098315917110389579109111","245043343799274195004920677230165162226","57422263235434590515045241750392427940","59015500389471837041038905899052443918","118099284940586869508348122016235463286","265574894259150924090948527212659091202","316720294682191939913563620517921928664","282122759152668967852973486630929312255","227844036395181515360167391951898475259","281190676006346082294275585421982810687","182861757898049314986528132443855924160","71533385097560297340457401550059246849","201931952282552815839172353408517663636","44129487902143717022613983661368552270","161514256329457173745399981174351516949","28357054698731760929515718037599800629","170762583274312928913663011781403440727","58872809487756423230059570533602939847","73940971459546940701641275979929627948","231705962236206492175213335507596385074","311523227167645088586501672371686170102","86805077921232558231215876332786132995","239396388795820340182317849971748437944","209699140460509886484590826372608910898","164563862767918218989789384201229151607","235401713606752884285268072149456742423","25742194637483730249751316859493536029","240035556240754023821103009492286199883","163682728199421485266735408385059560583","241461985943934559872636814277001087027","81606806994228283708652389672945295852","222339125647324931170318326631178400249","26274879494035163474676150767703322950","147420823394361005897563744831680657357","259947445757290828117018928436728081779","150984957338136754268952171407851534128","51457150403057725660309111931168724475","331525766790685225009947729462635040439","103061316731299019608733433715434478472"],"threshold":0.9},"id":"CVE-2026-53534-e5c7a5ce","signature_type":"Line","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToVim.java"}},{"target":{"file":"jabgui/src/main/java/org/jabref/gui/push/GuiPushToTexShop.java","function":"sendErrorNotification"},"deprecated":false,"digest":{"function_hash":"278757463650687339901441830253567878007","length":93},"id":"CVE-2026-53534-ead88b64","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2"},{"deprecated":false,"digest":{"function_hash":"272976038908483663949262187897479029332","length":812},"id":"CVE-2026-53534-f31de691","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToTexShop.java","function":"pushEntries"}},{"target":{"file":"jablib/src/main/java/org/jabref/logic/push/PushToVim.java","function":"onOperationCompleted"},"deprecated":false,"digest":{"function_hash":"37816385580127886066749025534521267805","length":378},"id":"CVE-2026-53534-f5b23260","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2"},{"digest":{"function_hash":"233595678208705171029898961300335143576","length":296},"id":"CVE-2026-53534-fac0085e","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"function":"determineCommandPath","file":"jablib/src/main/java/org/jabref/logic/push/PushToVim.java"},"deprecated":false},{"target":{"file":"jabsrv/src/main/java/org/jabref/http/server/cayw/CAYWResource.java"},"deprecated":false,"digest":{"line_hashes":["3147760630708239144177919815122496766","230990682488687742895928089062871131270","299558884795648550159650642618162459986","236780735097138504493207594003429737858","84611098048909848634075919058186735530","78161811061886675519431790320221554903","178100250657269673406077474037644264984","106063988882562060818571401644807351992","59476763756352258617813112989269447384","260666535183464895280219372861580065646","62543103781160119435100602198124502490","230954072005107223816369410978076386484","242813362881693357683992089069726508111","8657653724409371425853929697858473273","279233853835141489415035011751675746051","117032801408794260065113603378783237568"],"threshold":0.9},"id":"CVE-2026-53534-fae484f5","signature_type":"Line","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2"},{"id":"CVE-2026-53534-fe285fd9","signature_type":"Function","signature_version":"v1","source":"https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2","target":{"function":"jumpToLineCommandlineArguments","file":"jablib/src/main/java/org/jabref/logic/push/PushToTeXworks.java"},"deprecated":false,"digest":{"function_hash":"203767539365151585844503508192613445352","length":163}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}