Description

A vulnerability has been found in BareBones BBEdit up to 15.5.5. The affected element is an unknown function of the component Lasso Language Tokenizer. Such manipulation leads to infinite loop. The attack can be executed remotely. Upgrading to version 16.0 is sufficient to fix this issue. The affected component should be upgraded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-31T03:16:42.850Z",
  "pubdate": "2026-08-31T03:16:42.850Z",
  "executiveSummary": "A critical denial-of-service vulnerability has been identified in the Lasso Language Tokenizer component within BareBones BBEdit versions up to 15.5.5.\nThe vulnerability manifests as an infinite loop, triggered by specifically crafted input processed by the tokenizer.\nThis flaw allows a remote attacker to consume excessive system resources, effectively hanging the application process and rendering it unresponsive.\nThe vulnerability does not require authentication or elevated privileges, significantly lowering the barrier for exploitation.\nSuccessful exploitation results in a persistent denial-of-service state for the affected BBEdit instance, impacting workflow continuity.\nRisk implications are high for users who handle untrusted Lasso language files or operate in environments where remote files are automatically indexed or opened by the application.\nTo address this security defect, users are advised to upgrade to version 16.0, which contains the necessary remediation for the tokenizer logic.",
  "technicalDetails": "The vulnerability resides within the Lasso Language Tokenizer component of BareBones BBEdit versions 15.5.5 and earlier. The root cause is an improper state transition or loop termination condition within the tokenizer logic when parsing malicious or malformed Lasso syntax.\nWhen the tokenizer encounters a specific sequence of characters or an unexpected nesting structure, the internal state machine fails to increment its position counter or exit the parsing loop. This results in the processor entering an infinite loop, consuming 100% of the allocated CPU thread resources for that process.\nThe attack vector is remote, meaning that an attacker can trigger the infinite loop by providing a crafted file to the user or by hosting a malicious file on a remote server that the BBEdit instance attempts to parse or index. Because the vulnerability involves the tokenizer, it is triggered automatically upon the application's attempt to highlight, index, or parse the contents of the malicious file, requiring no complex exploitation techniques such as memory corruption or buffer overflows.\nThe attack flow follows these steps: 1. An attacker crafts a file containing a specific payload that triggers the flawed logic within the Lasso Language Tokenizer. 2. The attacker delivers this file to the victim, either via email, file sharing, or by tricking the user into opening a malicious document. 3. Upon loading the file, BBEdit’s Lasso Language Tokenizer attempts to tokenize the content. 4. The parser enters an infinite loop, stalling the application's main thread or background worker thread responsible for syntax highlighting. 5. The application becomes unresponsive, effectively denying service to the user and necessitating a manual process termination.\nBecause the issue involves resource exhaustion (Denial of Service), the impact is confined to the availability of the application. However, because BBEdit is frequently used in developer environments, an unresponsive IDE can lead to significant productivity losses and the potential loss of unsaved work in other open buffers if the application becomes entirely unresponsive and requires a force-quit."
}