# CVE-2026-13500: antlr ANTLR4 code injection in Grammar Action Block Handler

Source: https://junglewise.ai/threats/cve-2026-13500-antlr-antlr4-code-injection-in-grammar-action-block-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-28. Updated: 2026-06-28  
License: CC BY 4.0 with a link back

CVE-2026-13500 · Severity: high · CVSS 7.3 · Published 2026-06-28

ANTLR4 is a widely used tool for processing and translating structured text or code files. A security flaw in its grammar processing component allows for code injection, which could let an attacker run unauthorized commands on a system. This could lead to a full system compromise or unauthorized access to sensitive data if a developer processes a malicious grammar file.

Technologies: [ANTLR4](https://junglewise.ai/threats/technologies/antlr4). Vendors: [ANTLR](https://junglewise.ai/threats/vendors/antlr).

## Quick answers

**Is CVE-2026-13500 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13500 being exploited in the wild.

**How severe is CVE-2026-13500?** High severity, with a CVSS score of 7.3, published 28 June 2026.

**Which products and versions are affected?** ANTLR4 up to 4.13.2.

**Is there a fix for CVE-2026-13500?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13500 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-13500?** Check whether you run ANTLR4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A code injection vulnerability exists in ANTLR4 versions up to 4.13.2 within the Grammar Action Block Handler component, specifically in the 'tool/src/org/antlr/v4/codegen/model/OutputFile.java' file. The flaw stems from improper neutralization of special elements (CWE-74) and improper control of code generation (CWE-94) when processing grammar actions. A remote attacker can exploit this by providing a specially crafted grammar file that, when processed by the ANTLR tool, executes arbitrary code. A public exploit has been disclosed, and as of the advisory date, the vendor has not provided a patch or official response.

## Affected products

- antlr ANTLR4 up to 4.13.2

## Timeline

- 2026-06-28: disclosed: Public disclosure of the vulnerability and exploit.
- 2026-06-28: advisory: NVD/VulDB advisory published.

## References

- [https://github.com/wooyun123/wooyun/issues/4](https://github.com/wooyun123/wooyun/issues/4)
- [https://vuldb.com/cve/CVE-2026-13500](https://vuldb.com/cve/CVE-2026-13500)
- [https://vuldb.com/submit/838568](https://vuldb.com/submit/838568)
- [https://vuldb.com/vuln/374495](https://vuldb.com/vuln/374495)
- [https://vuldb.com/vuln/374495/cti](https://vuldb.com/vuln/374495/cti)

## Related threats

- [antlr ANTLR4 path traversal in TokenVocabParser](https://junglewise.ai/threats/cve-2026-13503-antlr-antlr4-path-traversal-in-tokenvocabparser)
- [antlr ANTLR4 command injection in GoTarget](https://junglewise.ai/threats/cve-2026-13501-antlr-antlr4-command-injection-in-gotarget)