CVE-2026-56389

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-56389
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56389.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-56389
Downstream
AZL (1)
DEBIAN (1)
ECHO (1)
JLSEC (1)
OESA (4)
UBUNTU (1)
Published
2026-07-29T09:39:52Z
Modified
2026-10-25T02:30:45Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:L/SI:L/SA:L CVSS Calculator
Summary
Arbitrary Command Execution in GNU Bison
Details

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to execvp().

When running bison --html on a attacker-provided grammar, this behavior allows execution of an arbitrary program with the privileges of the Bison process.

Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b. However, they did not provide vulnerable version range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

Database specific 
{
    "cna_assigner":  "CERT-PL",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56389.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "3.8.2"
                        },
                        {
                            "last_affected":  "3.8.2"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandaloneSingleVersion"
                }
            ]
        }
    ]
}
References

Affected packages

Git / cgit.git.savannah.gnu.org/cgit/bison.git

Affected ranges

Type
GIT
Repo
https://cgit.git.savannah.gnu.org/cgit/bison.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3169c1e7a2c6acc4c59dfcf8b089896d6881925b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "3169c1e7a2c6acc4c59dfcf8b089896d6881925b"
                }
            ],
            "source":  "DESCRIPTION"
        },
        {
            "range":  [
                {
                    "fixed":  "3169c1e7a2c6acc4c59dfcf8b089896d6881925b"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56389.json"