CVE-2026-56389

Name of the Vulnerable Software and Affected Versions GNU Bison version 3.8.2

Description Improper handling of grammar-defined configuration variables allows the execution of an arbitrary program during HTML report generation. A grammar file can override the executable used for the XML-to-HTML transformation step via the %define tool.xsltproc configuration, which is accepted without restriction and passed directly to the execvp() function. When the bison --html command is run on an attacker-provided grammar, it enables the execution of an arbitrary program with the privileges of the Bison process.

Recommendations Apply the fix implemented in commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b for version 3.8.2.