EUVD-2026-68323
GHSA-hcgm-vv9f-xh79
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
User must open a crafted Lasso file (UI:R); impact is limited to local application availability with no confidentiality, integrity, or scope-change effects.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in BareBones BBEdit up to 15.5.5. The affected element is an unknown function of the component Lasso Language Tokenizer. Such manipulation leads to infinite loop. The attack can be executed remotely. Upgrading to version 16.0 is sufficient to fix this issue. The affected component should be upgraded.
AnalysisAI
Infinite loop denial-of-service in BBEdit's Lasso Language Tokenizer affects all versions up to 15.5.5, allowing a remote attacker to hang the application by delivering a specially crafted Lasso language file that the victim opens. The vulnerability is limited to application-level availability loss with no confidentiality or integrity impact, and requires user interaction to trigger. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target user actively open or otherwise cause BBEdit to process a specially crafted Lasso language file (UI:P per CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) accurately reflects limited real-world impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade BBEdit to version 16.0 or later, which resolves this issue per the vendor advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The software update mechanism as used in Bare Bones Software Yojimbo before 4.0, TextWrangler before 4.5.3, and BBEdit b
Uncontrolled recursion in BBEdit's Java Language Module (versions through 15.5.5) allows a remote attacker to crash or h
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today