JabRef vulnerabilities

Products

• jabref 2

Latest JabRef CVEs

Newest publication first

1. CVE-2026-53534 JabRef CAYW Sublime Text integration permits operating-system command injection

   Published 2026-09-17

   High·CVSS 7.5 EPSS 0.45%

   JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand() passes it t...

2. CVE-2018-1000652 JabRef version <=4.3.1 contains a XML External Entity (XXE) vulnerability in MsBibImporter XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery...

   Published 2018-08-20

   Critical·CVSS 10.0 EPSS 1.9%

   JabRef version <=4.3.1 contains a XML External Entity (XXE) vulnerability in MsBibImporter XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted MsBi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.