Command Injection in ANTLR4 via gofmt

Executive Summary

CVE-2026-13501 is an OS command injection vulnerability in the ANTLR4 GoTarget class, specifically in version 4.13.2. The vulnerability occurs when ANTLR4 generates Go code using the `-Dlanguage=Go` flag and executes the `gofmt` binary via ProcessBuilder without specifying an absolute path. This causes the system to resolve `gofmt` using the PATH environment variable, which can be manipulated by an attacker.

An attacker who can control or prepend a malicious directory to the PATH can cause a crafted malicious `gofmt` executable to run instead of the legitimate one. This malicious executable runs with the privileges of the build process, enabling arbitrary code execution.

The root cause is the unsafe use of ProcessBuilder with a bare command name relying on PATH resolution without validation. Attack vectors include compromised build scripts, CI environment injections, or malicious `.envrc` files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary code execution with the privileges of the build process. An attacker who exploits this can execute malicious code on the affected system, potentially gaining full system access.

The impact includes compromise of confidentiality, integrity, and availability of the system. This means sensitive data could be exposed or altered, system operations disrupted, and unauthorized control gained.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the build environment or scripts use the `gofmt` command without specifying an absolute path, relying on the system PATH environment variable. An attacker can manipulate the PATH to execute a malicious `gofmt` binary.

To detect potential exploitation or presence of a malicious `gofmt` binary, you can check the PATH order and verify the location of the `gofmt` executable being used.

• Run `which gofmt` or `command -v gofmt` to see the path of the `gofmt` binary that will be executed.
• Inspect the PATH environment variable with `echo $PATH` to ensure no untrusted directories precede the legitimate `gofmt` binary location.
• Search for suspicious or unexpected `gofmt` binaries in directories listed in PATH using commands like `find $(echo $PATH | tr ':' ' ') -name gofmt -type f -exec ls -l {} \;`.
• Check build scripts, CI configurations, or `.envrc` files for any manipulation or prepending of PATH that could introduce malicious directories.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include ensuring that the `gofmt` binary is invoked using an absolute path rather than relying on the PATH environment variable.

Validate and restrict the PATH environment variable in build environments to exclude untrusted directories.

Review and sanitize build scripts, CI pipelines, and environment configuration files such as `.envrc` to prevent PATH manipulation.

If possible, configure the build process to allow specifying the exact location of the `gofmt` binary.

Monitor for any suspicious activity or unexpected binaries named `gofmt` in the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability enables OS command injection through manipulation of the PATH environment variable, potentially allowing attackers to execute arbitrary code with the privileges of the build process. Such unauthorized code execution can lead to breaches of confidentiality, integrity, and availability of data and systems.

Given these impacts, organizations using affected versions of ANTLR4 may face increased risks of data breaches or system compromises, which could result in non-compliance with standards and regulations like GDPR and HIPAA that mandate protection of sensitive data and system integrity.

Mitigating this vulnerability by applying recommended fixes (such as using absolute paths for binaries and validating executable locations) is important to maintain compliance with these regulations.

Useful 0 Not Useful 0