CVE-2026-56389 in Bison
Summary
by MITRE • 07/29/2026
GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to execvp(). When running bison --html on a attacker-provided grammar, this behavior allows execution of an arbitrary program with the privileges of the Bison process.
Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b. However, they did not provide vulnerable version range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
This vulnerability exists in GNU Bison where the HTML report generation functionality suffers from a critical command injection flaw that stems from improper input validation and privilege escalation. The vulnerability manifests when users provide grammar files containing specific configuration variables that override the executable used for XML-to-HTML transformation through the %define tool.xsltproc directive. This mechanism accepts user-defined values without any sanitization or restriction, directly passing them to the execvp() system call which executes programs with the privileges of the running Bison process.
The technical flaw represents a classic command injection vulnerability that aligns with CWE-78 and CWE-88 categories, where untrusted data flows into an executable function without proper validation. When bison --html processes a malicious grammar file, it interprets the user-supplied value for tool.xsltproc as an executable path and executes it directly through execvp(), bypassing all normal security controls that would normally prevent arbitrary code execution. This creates a privilege escalation scenario where an attacker can execute arbitrary programs with the same privileges as the Bison process, potentially leading to complete system compromise.
The operational impact of this vulnerability is severe as it allows remote code execution in environments where users can submit grammar files for processing. Systems that use Bison for automated documentation generation, build processes, or continuous integration pipelines become vulnerable to attackers who can craft malicious grammar files to execute arbitrary commands on the host system. The attack vector requires no special privileges beyond the ability to create or modify grammar files, making it particularly dangerous in multi-user environments or when Bison is used in automated workflows.
Mitigation strategies should focus on immediate patching of affected versions, with particular attention to version 3.8.2 which has been confirmed vulnerable. Organizations should implement strict input validation for configuration variables and avoid passing user-supplied values directly to system execution functions. The fix implemented by the maintainers in commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b likely involves sanitizing the tool.xsltproc directive values and implementing a whitelist of allowed executables. Additionally, system administrators should consider running Bison in restricted environments with minimal privileges and implement proper access controls to limit who can submit grammar files for processing.
This vulnerability also relates to ATT&CK technique T1059.007 for execution through scripting and T1203 for exploitation of software vulnerabilities, demonstrating how seemingly benign documentation generation features can become attack vectors in modern software ecosystems. The issue highlights the importance of security considerations in build tools and documentation generators that process user input, as these components often run with elevated privileges during automated workflows where such security flaws can be exploited with minimal user interaction required.