PT-2026-53112 · Antlr4 · Antlr4
CVSS v3.1
5.3
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
ANTLR4 versions prior to 4.13.3
Description
Command injection is possible in the
gofmt component via the GoTarget() function located in the tool/src/org/antlr/v4/codegen/target/GoTarget.java file. This issue allows an attacker to execute arbitrary commands, although the attack is limited to local environments.Recommendations
Update to a version newer than 4.13.2.
As a temporary mitigation, restrict access to the
GoTarget() function within the gofmt component.Exploit
Fix
Special Elements Injection
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Antlr4