Full Report
CERT Polska has received a report about 2 vulnerabilities (CVE-2026-56389 and CVE-2026-56390) found in GNU Bison software.
Analysis Summary
# Vulnerability: Multiple Flaws in GNU Bison (OS Command Injection and Path Traversal)
## CVE Details
- **CVE ID:** CVE-2026-56389, CVE-2026-56390
- **CVSS Score:** Not explicitly provided in report (Estimated High/Critical based on RCE and File Overwrite potential)
- **CWE:**
- CWE-78: Improper Neutralization of Special Elements used in an OS Command
- CWE-73: External Control of File Name or Path
## Affected Systems
- **Products:** GNU Bison
- **Versions:** 3.8.2 confirmed; other versions are likely vulnerable but untested.
- **Configurations:** Systems where Bison is used to process untrusted grammar files, specifically during HTML report generation.
## Vulnerability Description
GNU Bison contains two distinct vulnerabilities stemming from the improper handling of directives within grammar files:
1. **CVE-2026-56389 (OS Command Injection):** The software allows for arbitrary program execution during the `XML-to-HTML` transformation process. A grammar file can override the executable path using the `%define tool.xsltproc` variable. This input is passed to `execvp()` without restriction, allowing a malicious grammar file to execute arbitrary commands when Bison is run with the `--html` flag.
2. **CVE-2026-56390 (Path Traversal/Arbitrary File Write):** The software improperly handles grammar-defined output paths via directives like `%output` and `%header`. These directives override command-line options provided by the user, allowing an attacker to specify arbitrary writable locations on the filesystem. This can lead to the overwriting of sensitive files.
## Exploitation
- **Status:** PoC acknowledged in report (Disclosed via AFINE Team); no reports of exploitation in the wild currently provided.
- **Complexity:** Medium (Requires inducing a user/system to run Bison on a malicious grammar file).
- **Attack Vector:** Local (Processing a malicious file).
## Impact
- **Confidentiality:** High (Execution of arbitrary code).
- **Integrity:** High (Ability to overwrite any file the Bison process has write access to).
- **Availability:** High (Potential for system disruption via file deletion or overwriting).
## Remediation
### Patches
The vulnerabilities have been addressed in the source repository. Users should compile from source including the following commits or update to a version released after July 2026:
- **CVE-2026-56389 fix:** Commit `3169c1e7a2c6acc4c59dfcf8b089896d6881925b`
- **CVE-2026-56390 fix:** Commit `8d101c19d4d9aaedf83a448c925513742d4efcf0`
### Workarounds
- Do not process untrusted grammar files with the `--html` flag.
- Run Bison within a sandboxed environment or restricted container to limit filesystem access and execution privileges.
## Detection
- **Indicators of Compromise:** Unusual processes spawned by Bison (e.g., shells or unexpected binaries) or unexpected file modifications in system directories after running Bison.
- **Detection methods:** Inspect grammar files for the presence of `%define tool.xsltproc`, `%output`, or `%header` directives pointing to suspicious paths or binaries.
## References
- **CERT Polska Advisory:** hxxps[://]cert[.]pl/en/posts/2026/07/vulnerabilities-in-gnu-bison/
- **CVE Record (Command Injection):** hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-56389
- **CVE Record (Path Traversal):** hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-56390
- **CVD Policy:** hxxps[://]cert[.]pl/en/cvd/