CVE-2026-56389: Arbitrary Command Execution in GNU Bison
Arbitrary Command Execution in GNU Bison
Other sources
GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to execvp(). When running bison --html on a attacker-provided grammar, this behavior allows execution of an arbitrary program with the privileges of the Bison process.
Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b. However, they did not provide vulnerable version range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.8.2-2 - Upgrade
Upgrade
GNU Bisonto a version that resolves this vulnerability.Patch 3169c1e7a2c6acc4c59dfcf8b089896d6881925b
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56389?
CVE-2026-56389 has a medium severity rating of 6.8 based on the CVSS metrics.
What does CVE-2026-56389 affect?
CVE-2026-56389 affects GNU Bison, allowing for arbitrary command execution during HTML report generation.
How do I fix CVE-2026-56389?
To fix CVE-2026-56389, update GNU Bison to a version where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-56389 classified as?
CVE-2026-56389 is classified as an OS Command Injection vulnerability.
How does CVE-2026-56389 allow exploitation?
CVE-2026-56389 allows exploitation by improper handling of grammar-defined configuration variables that can override the executable used for XML-to-HTML transformation.