CVE-2026-53534
- Source
- https://cve.org/CVERecord?id=CVE-2026-53534
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53534.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-53534
- Aliases
-
- GHSA-m42c-cw93-p629
- Published
- 2026-09-17T21:42:47Z
- Modified
- 2026-09-19T08:14:20Z
- Severity
-
- 7.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- JabRef CAYW Sublime Text integration permits operating-system command injection
- Details
-
JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand() passes it through CAYWResource.getCitation() into PushToSublimeText.getCommandLine(). On Unix-like systems, PushToSublimeText combines this untrusted cite-command prefix and citation keys into a string executed through sh -c by ProcessBuilder without shell escaping. A client that can cause a localhost request with application=sublime can inject shell metacharacters and execute operating-system commands as the JabRef user when a valid Sublime Text command path is configured and the victim completes the CAYW selection dialog. The built-in server is disabled by default, so exploitation requires the victim to enable it or run jabsrv. This issue is fixed in version 6.0-alpha.6.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-78" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53534.json" }- References
-
- https://github.com/JabRef/jabref/releases/tag/v6.0-alpha.6
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53534.json
- https://github.com/JabRef/jabref/security/advisories/GHSA-m42c-cw93-p629
- https://nvd.nist.gov/vuln/detail/CVE-2026-53534
- https://github.com/JabRef/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2
- https://github.com/JabRef/jabref/pull/15628
Affected packages
Git / github.com/jabref/jabref
Affected versions
v3.*
v3.0
v3.1
v3.2
v3.3
v3.4
v3.5
v4.*
v4.0
v4.0-beta
v4.0-beta2
v4.0-beta3
v4.1
v4.2
v4.3
v5.*
v5.0
v5.0-alpha
v5.0-beta
v5.1
v5.10
v5.11
v5.12
v5.13
v5.14
v5.15
v5.2
v5.3
v5.4
v5.5
v5.6
v5.7
v5.8
v5.9
v6.*
v6.0-alpha
v6.0-alpha.3
v6.0-alpha.4
v6.0-alpha.5
v6.0-alpha2
v_2.*
v_2.10
v_2.10b2
v_2.10b3
v_2.11b
v_2.11b2
v_2.11b3
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53534.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"11738649890648111948646063958495324034",
"197168096351006517186115320741111719057",
"156946420283217365252537052240690298892",
"143538793057130260601859218746640469296",
"185540445609846095520786878375577100907",
"222339125647324931170318326631178400249",
"26274879494035163474676150767703322950",
"147420823394361005897563744831680657357",
"337114468069796811912957679348629393921",
"228922568170286308980481193253498476331",
"216408538955451142328033392274874536023",
"169485145789427790818528399594357639308",
"160539346816777999200735802223663334829",
"101112604188761789763233933514742635923",
"264530661336642747986042155163933869430",
"147877336080744098315917110389579109111",
"245043343799274195004920677230165162226",
"57422263235434590515045241750392427940",
"59015500389471837041038905899052443918",
"105863045948043030877630314016324090130",
"238382866306807960960276879029410709103",
"243077979490241498992979285032049004168",
"308670722837562377764934545437690085090",
"227844036395181515360167391951898475259",
"84024166758372108206024874585056392722",
"259883883648242146192118672313648211912",
"79729046199164932992977718367161036398",
"201931952282552815839172353408517663636",
"44129487902143717022613983661368552270",
"161514256329457173745399981174351516949",
"11019854003497768576087409867881713697",
"75622821651630043160288329989306467713",
"86713902544215155434307305413431974947",
"313854939257284936268439714283748407158",
"95559265716538390835964193721554145344"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-026afa08",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToEmacs.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"170097076382184849690472852634339771505",
"51429909377118046662906232973064918323",
"275410037581892794491153498708727678861",
"87104358080770394652839939336281028250",
"69438682714949640186740307527375030749",
"67398750253671090366190320161294243209",
"273882140512582769275253981269012854925"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-0a028a7b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToLyx.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"170097076382184849690472852634339771505",
"246505433618330527014851102203756163741",
"61030528599530946878312958954389872603",
"171940566999599508308704418803474012320",
"69438682714949640186740307527375030749",
"67398750253671090366190320161294243209",
"273882140512582769275253981269012854925"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-0bc1a760",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToTeXstudio.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"243738285177310295791484728013984052964",
"259589232845146509230696225362263363506",
"129369210989805020700927486897428067399",
"273244309356143636667120822416111133663",
"295182455456892821989515803427824765720",
"21517482807549661651533970207123335274"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-0df6a7fb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToWinEdt.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"170097076382184849690472852634339771505",
"51429909377118046662906232973064918323",
"275410037581892794491153498708727678861",
"87104358080770394652839939336281028250",
"69438682714949640186740307527375030749",
"67398750253671090366190320161294243209",
"273882140512582769275253981269012854925"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-1a95d85c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToEmacs.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"170097076382184849690472852634339771505",
"51429909377118046662906232973064918323",
"275410037581892794491153498708727678861",
"87104358080770394652839939336281028250",
"69438682714949640186740307527375030749",
"67398750253671090366190320161294243209",
"273882140512582769275253981269012854925"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-204a1209",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToVim.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "278757463650687339901441830253567878007",
"length": 93
},
"id": "CVE-2026-53534-2214a9fd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToLyx.java",
"function": "sendErrorNotification"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"16348589303532722291746176337883278",
"142987962738759142186566021076488480931"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-29810ac5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabsrv/src/test/java/org/jabref/http/server/cayw/CAYWResourceTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "298035160414197153269197283073586777999",
"length": 992
},
"id": "CVE-2026-53534-31314779",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToLyx.java",
"function": "pushEntries"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "215669189115833037010496875223397414545",
"length": 292
},
"id": "CVE-2026-53534-342341d8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/test/java/org/jabref/gui/push/PushToTeXworksTest.java",
"function": "pushEntries"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "131584086475151966305801821094619251569",
"length": 662
},
"id": "CVE-2026-53534-36af71df",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/AbstractPushToApplication.java",
"function": "onOperationCompleted"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"195412797108280837704772402501462184220",
"213463429485867829360680614588704606828",
"75928610343376904616829200304554181838",
"14847533060384911589277148251747409649",
"153976844653366762081009909631828432979",
"100549115590273928691710527989143955393",
"222114412914055601864671703976850288595",
"222339125647324931170318326631178400249",
"266750641818375692240658185626740416716",
"156628825842125225263678796249380752983",
"260788784886676555135547947287019215735",
"279715450091514268524198255227626768703",
"238459846716571796118652915674159801651",
"36548322529987336282087810557495691719",
"287238031241702173094701269780619729140",
"110352735232872876564767278320989356781",
"104342379498061847230602529692502439657",
"9079867555399374394584028781924823558",
"267932987718056352759735478609651558995",
"286340974469666409483790509426589776160",
"165746065515203274801304168511373086521",
"67166422802442112275460800594703828275",
"282690997664070899492950344796138756113",
"165065667587450138429788743926478025480",
"199802198300924297887377684206896557240",
"131999989739761441285599077186330569512",
"108592341240473393139530129249128391548",
"11293261933042149802791164017627298275",
"174265778183900686444380009518278318586",
"211033126914466677278092001048301917667",
"235560643060724828293711214828773576507",
"228592633208969680238634045261675963829",
"43134763012368075088028977884237859006",
"21631960376315084270951273179916478777",
"177475016433751158833256686081773623628",
"84424303660123597888548593891028012535",
"279560501835142983034415002249512468664",
"194387710463427874374448154148999393009",
"53928932622641324400953316632404383937",
"206608091612954792328697461914489688537",
"223765814600850473788546451421843305957",
"269528006582222182803333377815202314656",
"35484812046498476075117605256494944812",
"1417220583367458761933751171703472167",
"260788784886676555135547947287019215735"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-3a5790fc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/AbstractPushToApplication.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "286954278940420158863245566335946277147",
"length": 176
},
"id": "CVE-2026-53534-3c8c1848",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/test/java/org/jabref/gui/push/PushToTeXworksTest.java",
"function": "getCommandLine"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "265319644520430585963546989104501495438",
"length": 1015
},
"id": "CVE-2026-53534-3d7cc33f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToSublimeText.java",
"function": "pushEntries"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "262122538066916185976360459822329624646",
"length": 190
},
"id": "CVE-2026-53534-41ed1eb0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToVim.java",
"function": "jumpToLineCommandlineArguments"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"170097076382184849690472852634339771505",
"246505433618330527014851102203756163741",
"61128527144723598830061726705351552811",
"132962967688296059875494376809728808901",
"69438682714949640186740307527375030749",
"67398750253671090366190320161294243209",
"273882140512582769275253981269012854925"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-491b7134",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToTexmaker.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "243684408234991826683040787549193390899",
"length": 691
},
"id": "CVE-2026-53534-4ba7a16a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToTexShop.java",
"function": "getCommandLine"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "59629344022899340821229176802997889844",
"length": 1142
},
"id": "CVE-2026-53534-4f3ce4f8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToVim.java",
"function": "pushEntries"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "207671887350100842102847018681279043074",
"length": 865
},
"id": "CVE-2026-53534-58276bb2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToVim.java",
"function": "jumpToLine"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"170097076382184849690472852634339771505",
"246505433618330527014851102203756163741",
"59305494354003629866086527941671395517",
"111294017578464149713790910794502117098",
"69438682714949640186740307527375030749",
"67398750253671090366190320161294243209",
"273882140512582769275253981269012854925"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-5e15c08b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToVScode.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"170097076382184849690472852634339771505",
"246505433618330527014851102203756163741",
"329885719149279908677308636854757764137",
"246064459426628036684121660820888902063",
"69438682714949640186740307527375030749",
"67398750253671090366190320161294243209",
"273882140512582769275253981269012854925"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-6681bb5b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToSublimeText.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "123762459297931126178001329495309862177",
"length": 393
},
"id": "CVE-2026-53534-6d69040d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToEmacs.java",
"function": "onOperationCompleted"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"149228805980029640898318463502174184195",
"222255444502300511917360372447155042654",
"228490993468969159933969646584397096696",
"222339125647324931170318326631178400249",
"266750641818375692240658185626740416716",
"156628825842125225263678796249380752983",
"260788784886676555135547947287019215735",
"43391874647741980859531936120535453298",
"63774564344056273149494632222793364793",
"168835653730514576804877714520296106392",
"205408620071132351726384221687134513004",
"158586488401357781931165828733307997376",
"202971717279531084842266591029699382688",
"12818020109035118311392030548640399915",
"198032042059900135910865154119861582965",
"213990462666394392372075950482582711320",
"36295865876173629742483704850922222349",
"44082156144099813522406555343977582670",
"9492660327646341262069536886124492556",
"247079771832548668324102502536849198426",
"15039142898271747683264554747949440463",
"45620787297709886567892838471153046952",
"249439466545137340903766859312004495330",
"171626645666346421886336523088261631641",
"42200235798094563884111045805148503502",
"201931952282552815839172353408517663636",
"42998666441684470199660296952051302993",
"55899291074326367441168177650941910659",
"309307860289889964319136937527228250215",
"64701623207865379458075811156332238377",
"44042700659994415110938392416528180277",
"126212785445268549413907189345946523851",
"306001137066924218355900977157504433024",
"24132217767311798270178264859690619721",
"140414244408935997220361494582350336247",
"296004788866619637186763378284816105972"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-7d6d3012",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToSublimeText.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "40541735523947437135398384928187280796",
"length": 849
},
"id": "CVE-2026-53534-7ea4d74f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/AbstractPushToApplication.java",
"function": "pushEntries"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"127182126879966292779169787060200443686",
"61948974344691389028931573669879398383",
"841896310471024738242024584851653429",
"219495840929811375677178406074730449163",
"178129091092767635305164795886062889160"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-845a7961",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/CitationCommandString.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"316007367462411469571681814757302264222",
"96747194673797430752083944685743371454",
"116268333148848490977496588383878771346",
"330764606207052077247239758493987562267",
"337170409152136279520359769370717497948",
"5819706179935855748119734205181858793",
"140793942382066641655680167495884093694",
"331626214315369676284312072114588800010",
"98210697223665462512240866198458358311",
"259996288000071935760835823727414474255",
"223100316831335809054824424973974181454",
"111970625247460966470621461367358470393",
"203686972339844877065042201243438592250",
"117869552132283202714072521262193439153"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-875c1391",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/test/java/org/jabref/gui/push/PushToTeXworksTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "176800736800395396612597381446307949836",
"length": 499
},
"id": "CVE-2026-53534-9082614c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/AbstractPushToApplication.java",
"function": "jumpToLine"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"148736079884954535819144030245369307441",
"92852344256470886757044847559358844727",
"156946420283217365252537052240690298892",
"143538793057130260601859218746640469296",
"185540445609846095520786878375577100907",
"222339125647324931170318326631178400249",
"26274879494035163474676150767703322950",
"147420823394361005897563744831680657357",
"337114468069796811912957679348629393921",
"228922568170286308980481193253498476331"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-96ecebab",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToLyx.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"170097076382184849690472852634339771505",
"246505433618330527014851102203756163741",
"283333683058941575924272302434835096408",
"197818026612307423424417379105458166646",
"69438682714949640186740307527375030749",
"67398750253671090366190320161294243209",
"273882140512582769275253981269012854925"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-985f99d4",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToWinEdt.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"170097076382184849690472852634339771505",
"246505433618330527014851102203756163741",
"17168468040655293903327024812661068695",
"228389888428649345052186654308311198068",
"69438682714949640186740307527375030749",
"67398750253671090366190320161294243209",
"273882140512582769275253981269012854925"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-9bf8472f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToTeXworks.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"222339125647324931170318326631178400249",
"47892718144661618692746055336034090181",
"79148786263301128059475531264996928597",
"201830758531124676437525561449440722061",
"111259317253041655754279986397162214044",
"158433057710196799818319637714457239848",
"97303299593329557654110139610362496237",
"256850062859772700679680331398739268992",
"308045489802079304617952255628352330781",
"9492660327646341262069536886124492556",
"247079771832548668324102502536849198426",
"15039142898271747683264554747949440463",
"45620787297709886567892838471153046952",
"249439466545137340903766859312004495330",
"171626645666346421886336523088261631641",
"42200235798094563884111045805148503502",
"201931952282552815839172353408517663636",
"186571175495905902106717323853478511101",
"307265400548902911650213006402823021143",
"322297986519003628844415145065790416848",
"155044381644359015291310246342230323620",
"117248848676463086916800138792944933684",
"279854266735352286369004453771208396798",
"116180617498450676010586612347436934074",
"296574765342859435237408870435578752069",
"328726311023453345662993425051255890187",
"244762396287967830656363099846508384501",
"221787521795926852280136608647645309896",
"82662530264427797989650421295311409459",
"100666462151711445889358156247550742341",
"246272815559739908145605384252247969575",
"275537818722515664054443316650635532212",
"98439014766388012616602913104709610399",
"196363718740459053386774709444577392223",
"271834745622319258512957767809842833731",
"290179026059174610379693911037502741575",
"24732658451842818156731738963073296031",
"3583108802881146704279750078143437669"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-9ccde398",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToTexShop.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "278757463650687339901441830253567878007",
"length": 93
},
"id": "CVE-2026-53534-9ec5485f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToVim.java",
"function": "sendErrorNotification"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "278757463650687339901441830253567878007",
"length": 93
},
"id": "CVE-2026-53534-a342efbc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToSublimeText.java",
"function": "sendErrorNotification"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"247349452504920336423305692384237326079",
"325062770340356500172923730450928327264",
"258418431859722597041029242099117079623"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-a469e997",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToTeXworks.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "278757463650687339901441830253567878007",
"length": 93
},
"id": "CVE-2026-53534-a9897129",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToTeXstudio.java",
"function": "sendErrorNotification"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "54499789525988315001254082961803334558",
"length": 1974
},
"id": "CVE-2026-53534-b373ecff",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToEmacs.java",
"function": "pushEntries"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "328217384732799666425797951246837853509",
"length": 477
},
"id": "CVE-2026-53534-b5ee61dd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToSublimeText.java",
"function": "getCommandLine"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "100958567617523180480708179477543113943",
"length": 161
},
"id": "CVE-2026-53534-c1579a03",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToWinEdt.java",
"function": "getCommandLine"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "278757463650687339901441830253567878007",
"length": 93
},
"id": "CVE-2026-53534-c8b31900",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToWinEdt.java",
"function": "sendErrorNotification"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "278757463650687339901441830253567878007",
"length": 93
},
"id": "CVE-2026-53534-d1f5ccd3",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToTexmaker.java",
"function": "sendErrorNotification"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "278757463650687339901441830253567878007",
"length": 93
},
"id": "CVE-2026-53534-d47c1870",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToTeXworks.java",
"function": "sendErrorNotification"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "23090182154992913568564188197638542438",
"length": 2365
},
"id": "CVE-2026-53534-d5d82f75",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabsrv/src/main/java/org/jabref/http/server/cayw/CAYWResource.java",
"function": "getCitation"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "278757463650687339901441830253567878007",
"length": 93
},
"id": "CVE-2026-53534-d71bb780",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToEmacs.java",
"function": "sendErrorNotification"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "278757463650687339901441830253567878007",
"length": 93
},
"id": "CVE-2026-53534-d7e443f1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToVScode.java",
"function": "sendErrorNotification"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "321892578485842126786336907461432498760",
"length": 36
},
"id": "CVE-2026-53534-d9fba862",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/AbstractPushToApplication.java",
"function": "getCommandName"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"170097076382184849690472852634339771505",
"246505433618330527014851102203756163741",
"304615688290158571520869045251604877534",
"203586240565375715754283234581714517906",
"69438682714949640186740307527375030749",
"67398750253671090366190320161294243209",
"273882140512582769275253981269012854925"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-e2181ec1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToTexShop.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"11738649890648111948646063958495324034",
"197168096351006517186115320741111719057",
"156946420283217365252537052240690298892",
"143538793057130260601859218746640469296",
"264530661336642747986042155163933869430",
"147877336080744098315917110389579109111",
"245043343799274195004920677230165162226",
"57422263235434590515045241750392427940",
"59015500389471837041038905899052443918",
"118099284940586869508348122016235463286",
"265574894259150924090948527212659091202",
"316720294682191939913563620517921928664",
"282122759152668967852973486630929312255",
"227844036395181515360167391951898475259",
"281190676006346082294275585421982810687",
"182861757898049314986528132443855924160",
"71533385097560297340457401550059246849",
"201931952282552815839172353408517663636",
"44129487902143717022613983661368552270",
"161514256329457173745399981174351516949",
"28357054698731760929515718037599800629",
"170762583274312928913663011781403440727",
"58872809487756423230059570533602939847",
"73940971459546940701641275979929627948",
"231705962236206492175213335507596385074",
"311523227167645088586501672371686170102",
"86805077921232558231215876332786132995",
"239396388795820340182317849971748437944",
"209699140460509886484590826372608910898",
"164563862767918218989789384201229151607",
"235401713606752884285268072149456742423",
"25742194637483730249751316859493536029",
"240035556240754023821103009492286199883",
"163682728199421485266735408385059560583",
"241461985943934559872636814277001087027",
"81606806994228283708652389672945295852",
"222339125647324931170318326631178400249",
"26274879494035163474676150767703322950",
"147420823394361005897563744831680657357",
"259947445757290828117018928436728081779",
"150984957338136754268952171407851534128",
"51457150403057725660309111931168724475",
"331525766790685225009947729462635040439",
"103061316731299019608733433715434478472"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-e5c7a5ce",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToVim.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "278757463650687339901441830253567878007",
"length": 93
},
"id": "CVE-2026-53534-ead88b64",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabgui/src/main/java/org/jabref/gui/push/GuiPushToTexShop.java",
"function": "sendErrorNotification"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "272976038908483663949262187897479029332",
"length": 812
},
"id": "CVE-2026-53534-f31de691",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToTexShop.java",
"function": "pushEntries"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "37816385580127886066749025534521267805",
"length": 378
},
"id": "CVE-2026-53534-f5b23260",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToVim.java",
"function": "onOperationCompleted"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "233595678208705171029898961300335143576",
"length": 296
},
"id": "CVE-2026-53534-fac0085e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToVim.java",
"function": "determineCommandPath"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"3147760630708239144177919815122496766",
"230990682488687742895928089062871131270",
"299558884795648550159650642618162459986",
"236780735097138504493207594003429737858",
"84611098048909848634075919058186735530",
"78161811061886675519431790320221554903",
"178100250657269673406077474037644264984",
"106063988882562060818571401644807351992",
"59476763756352258617813112989269447384",
"260666535183464895280219372861580065646",
"62543103781160119435100602198124502490",
"230954072005107223816369410978076386484",
"242813362881693357683992089069726508111",
"8657653724409371425853929697858473273",
"279233853835141489415035011751675746051",
"117032801408794260065113603378783237568"
],
"threshold": 0.9
},
"id": "CVE-2026-53534-fae484f5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jabsrv/src/main/java/org/jabref/http/server/cayw/CAYWResource.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "203767539365151585844503508192613445352",
"length": 163
},
"id": "CVE-2026-53534-fe285fd9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/jabref/jabref/commit/b8663fe58e6c87c3927cdb4eeb1f6934d7c3f1d2",
"target": {
"file": "jablib/src/main/java/org/jabref/logic/push/PushToTeXworks.java",
"function": "jumpToLineCommandlineArguments"
}
}
]
vanir_signatures_modified
"2026-09-19T08:14:20Z"