Description
A vulnerability has been found in BareBones BBEdit up to 15.5.5. The affected element is an unknown function of the component Lasso Language Tokenizer. Such manipulation leads to infinite loop. The attack can be executed remotely. Upgrading to version 16.0 is sufficient to fix this issue. The affected component should be upgraded.
Published: 2026-08-31
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the Lasso Language Tokenizer of BareBones BBEdit and causes an infinite loop when the tokenizer processes a crafted input. This results in resource exhaustion, preventing normal operation and leading to a denial of service. The weakness aligns with CWE-404 (Improper Resource Handling) and CWE-835 (Infinite Loop).

Affected Systems

Affected systems include any installation of BareBones BBEdit through version 15.5.5. The product is listed as BareBones:BBEdit with a CPE indicating use of the Lasso tokenizer component. Upgrading to version 16.0 removes the bug, as noted by the vendor.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available, and the vulnerability is not present in CISA's KEV catalog. According to the description, an attacker can exploit the flaw remotely, likely by sending a specially crafted input to the tokenizer. While the impact is limited to a DoS, the lack of an exploit‑prevention mechanism means an adversary could repeatedly trigger the infinite loop on any exposed BBEdit instance, potentially disrupting services.

Generated by OpenCVE AI on August 31, 2026 at 03:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade all installations of BBEdit to version 16.0 or later, as the vendor indicates the issue is fixed in that release.
  • Disable or remove custom Lasso language modules or any plugins that invoke the tokenizer until an updated version is in place.
  • After the upgrade, monitor application performance for signs of high CPU or memory consumption that could indicate repeated tokenization of malicious input, and restrict remote access to BBEdit if possible.

Generated by OpenCVE AI on August 31, 2026 at 03:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in BareBones BBEdit up to 15.5.5. The affected element is an unknown function of the component Lasso Language Tokenizer. Such manipulation leads to infinite loop. The attack can be executed remotely. Upgrading to version 16.0 is sufficient to fix this issue. The affected component should be upgraded.
Title BareBones BBEdit Lasso Language Tokenizer infinite loop
First Time appeared Barebones
Barebones bbedit
Weaknesses CWE-404
CWE-835
CPEs cpe:2.3:a:barebones:bbedit:*:*:*:*:*:*:*:*
Vendors & Products Barebones
Barebones bbedit
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Barebones Bbedit
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T02:15:09.051Z

Reserved: 2026-08-30T07:14:44.217Z

Link: CVE-2026-82605

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-31T03:16:42.850

Modified: 2026-08-31T03:16:42.850

Link: CVE-2026-82605

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T05:00:04Z

Weaknesses
  • CWE-404

    Improper Resource Shutdown or Release

  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')