JabRef EUVD-2026-82565

Exploitation requires ALL of: (1) JabRef's built-in HTTP server enabled or jabsrv running - both disabled by default, so the operator must have opted in; (2) a valid Sublime Text command path configured as a push target in JabRef; (3) the ability to cause a localhost request to GET /better-bibtex/cayw with application=sublime (e.g. via a malicious web page or local process); and (4) the victim actively completing the CAYW citation selection dialog (UI:A). Only Unix-like systems are affected, since PushToSublimeText routes the command through sh -c. These layered non-default and interaction requirements are the primary limiting factors, matching the vendor's AC:H/AT:P/UI:A rating.

This is a genuine remote command-execution flaw (CWE-78) but with a stacked set of preconditions that sharply reduce real-world risk. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H, 7.5) already encodes this: AC:H, AT:P (a specific attack requirement), and UI:A (active/passive victim interaction) all signal that the network-vector, no-privileges rating is heavily gated. Multiple conditions must line up simultaneously: the built-in HTTP server or jabsrv must be running (disabled by default), the victim must have configured a valid Sublime Text command path, and the victim must complete the CAYW selection dialog. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so the exploitation status is 'no public exploit identified at time of analysis'. The impact when it does fire is severe - arbitrary OS command execution as the JabRef user - but the combination of a non-default feature, a specific editor configuration, and required user interaction makes this a lower-priority patch item than the raw C:H/I:H/A:H impact would suggest. Note the PR:N rating reflects that no JabRef authentication is needed to reach the localhost endpoint, not that the attack is condition-free.

A victim who has enabled JabRef's built-in HTTP server (or runs jabsrv) and has configured Sublime Text as a push target visits an attacker-controlled web page; the page issues a localhost request to GET /better-bibtex/cayw with application=sublime and a command parameter containing shell metacharacters. When the victim completes the CAYW selection dialog, PushToSublimeText builds an unescaped string passed to sh -c via ProcessBuilder, executing the injected commands as the JabRef user. No public POC was provided in the intelligence set.