Arbitrary Code Execution Vulnerability in GNU Bison During HTML Report Generation

CVE-2026-56389

What is CVE-2026-56389?

GNU Bison is susceptible to a vulnerability that permits arbitrary code execution during the generation of HTML reports. This flaw arises from improper handling of grammar-defined configuration variables, allowing an attacker to alter the executable used in the XML-to-HTML transformation process through the %define tool.xsltproc directive. As a result, when the 'bison --html' command is executed with a crafted grammar file supplied by an attacker, it can lead to execution of arbitrary programs with the privileges of the Bison process. Although the maintainers addressed this issue in a recent commit, documentation concerning the scope of vulnerable versions is lacking. Version 3.8.2 has been confirmed as vulnerable, while other versions have not been explicitly tested.

References