EUVD-2026-39998
GHSA-m64j-m5c8-f58p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
UI:R because a developer or pipeline must actively process the malicious grammar file; S:C and C:H/I:H/A:H reflect full code execution on the host.
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in antlr ANTLR4 up to 4.13.2. Affected is an unknown function of the file tool/src/org/antlr/v4/codegen/model/OutputFile.java of the component Grammar Action Block Handler. Executing a manipulation can lead to code injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Code injection in ANTLR4's Grammar Action Block Handler allows remote attackers to execute arbitrary code by supplying a crafted grammar file processed by the tool. All versions up to and including 4.13.2 are affected via the OutputFile.java code generation pathway. A public proof-of-concept exploit exists on GitHub (no KEV listing), though the vendor has not acknowledged or patched the issue, leaving users without an official fix.
Technical ContextAI
ANTLR4 (Another Tool for Language Recognition, version 4) is a widely-used Java-based parser generator that compiles grammar files (.g4) into lexers and parsers. Grammar action blocks are Java code snippets embedded directly in grammar files; ANTLR4 processes these blocks via OutputFile.java during the code generation phase and interpolates them into generated source files. CWE-94 (Improper Control of Generation of Code / Code Injection) covers scenarios where user-controlled input - here, a grammar action block - is incorporated into generated code or interpreted in a privileged context without sufficient sanitization. The CPE (cpe:2.3:a:antlr:antlr4:*:*:*:*:*:*:*:*) confirms the entire ANTLR4 product family up to 4.13.2 is in scope. Because ANTLR4 typically runs in developer or CI/CD environments with elevated local privileges, successful exploitation yields code execution in a highly sensitive context.
RemediationAI
No vendor-released patch has been identified at time of analysis, and the vendor did not respond to the coordinated disclosure. Until a patch is available, organizations should avoid processing untrusted or externally-sourced ANTLR4 grammar files (.g4) through any ANTLR4 toolchain at or below version 4.13.2. Specific compensating controls include: restricting ANTLR4 execution to isolated CI/CD sandbox environments with no network egress, so that any injected code cannot beacon out; enforcing cryptographic integrity checks (e.g., checksums or signed commits) on all grammar files before they enter the build pipeline to detect unauthorized modifications; and pinning grammar file sources to trusted internal repositories rather than pulling from public registries. Note that sandbox isolation does not prevent code injection into generated parser output files, which may then be compiled and executed downstream - downstream build steps should also be reviewed. Monitor the VulDB tracking page at https://vuldb.com/vuln/374495 and the ANTLR4 GitHub releases for an official patch release.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-94 – Code Injection
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.3 | Affected |
| openSUSE Leap 15.4 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today