CVE-2026-56389

Awaiting Analysis Awaiting Analysis - Queue

Command Injection in GNU Bison via %define tool.xsltproc

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: CERT.PL

Description

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to execvp(). When running bison --html on a attacker-provided grammar, this behavior allows execution of an arbitrary program with the privileges of the Bison process. Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b. However, they did not provide vulnerable version range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-56389

Affected Vendors & Products

Vendor	Product	Version / Range
gnu	bison	From 3.8.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

GNU Bison has a flaw where an attacker can trick it into running any program during HTML report generation. This happens because grammar files can specify a custom executable for XML-to-HTML conversion without proper checks, allowing arbitrary command execution with Bison's privileges.

Detection Guidance

To detect this vulnerability, check if GNU Bison is installed and inspect grammar files for %define tool.xsltproc usage. Run bison --html on test grammars to observe if unexpected programs execute. Version 3.8.2 is confirmed vulnerable; other versions may also be affected.

Impact Analysis

If you use Bison to process untrusted grammar files, an attacker could execute malicious code on your system with the same permissions as Bison. This could lead to data theft, system compromise, or further network attacks.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized code execution, potentially leading to data breaches or loss of data integrity. Organizations may face penalties for failing to protect systems handling sensitive data.

Mitigation Strategies

Apply the patch from commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b. Avoid using untrusted grammar files with bison --html. Update to the latest patched version if available. Monitor Bison's project updates for further fixes.

Hi! I’m here to help you understand CVE-2026-56389. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70