Executive brief
ANTLR4 is a widely used tool for processing and translating structured text or code files. A security flaw in its grammar processing component allows for code injection, which could let an attacker run unauthorized commands on a system. This could lead to a full system compromise or unauthorized access to sensitive data if a developer processes a malicious grammar file.
Technical details
A code injection vulnerability exists in ANTLR4 versions up to 4.13.2 within the Grammar Action Block Handler component, specifically in the 'tool/src/org/antlr/v4/codegen/model/OutputFile.java' file. The flaw stems from improper neutralization of special elements (CWE-74) and improper control of code generation (CWE-94) when processing grammar actions. A remote attacker can exploit this by providing a specially crafted grammar file that, when processed by the ANTLR tool, executes arbitrary code. A public exploit has been disclosed, and as of the advisory date, the vendor has not provided a patch or official response.
Affected products
- antlr ANTLR4 up to 4.13.2
Timeline
- 2026-06-28: disclosed: Public disclosure of the vulnerability and exploit.
- 2026-06-28: advisory: NVD/VulDB advisory published.