CVE-2026-56389

A flaw was found in GNU Bison. During HTML report generation, the software improperly handles grammar-defined configuration variables. An attacker can provide a specially crafted grammar file that overrides the executable used for XML-to-HTML transformation. This allows for the execution of an arbitrary program with the privileges of the Bison process, leading to arbitrary code execution.

This is a Moderate arbitrary code execution flaw in GNU Bison. The vulnerability arises when the bison --html command processes a specially crafted grammar file, enabling an attacker to define and execute an arbitrary program with the privileges of the Bison process. Exploitation requires user interaction to process a malicious grammar file, which limits the attack surface to scenarios where untrusted input is explicitly processed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, avoid processing untrusted or unverified grammar files with the bison --html command. Restrict the use of bison --html to trusted input sources only. This operational control reduces the risk of arbitrary code execution by preventing the vulnerable code path from being triggered with malicious input.