RCE in Gnu Bison
CVE-2026-56389
GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation…
Vulnerability class: Command Injection (OS Command Injection)
Affected products
- Gnu Bison — versions 3.8.2
Weakness classification (CWE)
References
- cvd@cert.pl (third-party-advisory)
- cvd@cert.pl (product)
- cvd@cert.pl (patch)