Skip to main content

GNU Bison EUVDEUVD-2026-50276

| CVE-2026-56389 MEDIUM
OS Command Injection (CWE-78)
2026-07-29 CERT-PL GHSA-735p-4prj-f62v
Command Injection Bison Gnu
6.8
CVSS 4.0 · Vendor: CERT-PL
Share

Severity by source

Vendor (CERT-PL) PRIMARY
6.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.1 MEDIUM

Local file delivery with required user interaction (UI:R); no attacker privileges needed (PR:N); integrity is fully compromised via arbitrary execution, confidentiality unaffected.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:L/SI:L/SA:L
SUSE
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jul 29, 2026 - 10:56 vuln.today

DescriptionCVE.org

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to execvp().

When running bison --html on a attacker-provided grammar, this behavior allows execution of an arbitrary program with the privileges of the Bison process.

Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b. However, they did not provide vulnerable version range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

AnalysisAI

Arbitrary program execution in GNU Bison (confirmed in 3.8.2) is triggered when a developer or automated pipeline runs bison --html on an attacker-controlled grammar file. The %define tool.xsltproc directive - intended to specify the XSLT processor binary for HTML report generation - is accepted without any restriction and passed directly to execvp(), allowing complete substitution of the transformation executable. No public exploit code or active exploitation has been identified at time of analysis, but the attack surface is relevant to developer workstations, build servers, and CI/CD pipelines that process untrusted grammar files.

Technical ContextAI

GNU Bison (CPE: cpe:2.3:a:gnu:bison:*:*:*:*:*:*:*:*) is a widely-used LALR/GLR parser generator that can produce HTML reports via the --html flag. This feature invokes an external XSLT processor (typically xsltproc) to transform an intermediate XML representation into HTML. Bison's grammar syntax supports %define directives, including tool.xsltproc, which allows grammar authors to override the executable used in this transformation step. The vulnerability (CWE-78: OS Command Injection) arises because this user-controlled value is passed without sanitization or allowlisting directly to execvp(), which executes arbitrary programs. The root cause is a trust boundary violation: grammar file content - potentially supplied by untrusted parties - is treated as trusted configuration that can influence process execution at the OS level.

RemediationAI

The primary fix is to apply the upstream patch available at commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b from the GNU Bison repository (https://cgit.git.savannah.gnu.org/cgit/bison.git/commit/?id=3169c1e7a2c6acc4c59dfcf8b089896d6881925b). A formally tagged patched release version has not been confirmed in available data - monitor the upstream project and the CERT-PL advisory (https://cert.pl/en/posts/2026/07/CVE-2026-56389) for a versioned release. Until a patch is applied, the primary compensating control is to avoid invoking bison --html on grammar files from untrusted sources; this eliminates the attack path entirely since the vulnerability is exercised only during HTML report generation. In CI/CD pipelines, restrict the --html flag to grammar files from trusted, version-controlled internal sources and run Bison in a sandboxed environment (e.g., a container with no sensitive credentials or network access) to limit blast radius if exploitation occurs. Note that disabling HTML report generation may affect documentation workflows that depend on this output.

More in Bison

View all
CVE-2020-24240 MEDIUM
5.5 Aug 25

GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is
CVE-2020-14150 MEDIUM
5.5 Jun 15

GNU Bison before 3.5.4 allows attackers to cause a denial of service (application crash). Rated medium severity (CVSS 5.
CVE-2026-56390 MEDIUM
4.6 Jul 29

GNU Bison's grammar directive processing exposes an arbitrary file write path via the %output and %header directives, wh

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Not-Affected

Share

EUVD-2026-50276 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy