Is CVE-2026-13501 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13501 being exploited in the wild.

How severe is CVE-2026-13501?

Medium severity, with a CVSS score of 5.3, published 28 June 2026.

Is there a fix for CVE-2026-13501?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13501 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-13501?

Check whether you run ANTLR4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13501: antlr ANTLR4 command injection in GoTarget

CVE-2026-13501 · Severity: medium · CVSS 5.3 · Published 2026-06-28

A security vulnerability exists in ANTLR4, a widely used tool for processing structured text and programming languages. When generating Go code, the software fails to properly handle certain inputs, which could allow a local user to execute unauthorized commands on the system. This could lead to a compromise of the local machine's integrity and data.

Technologies: ANTLR4. Vendors: ANTLR.

Quick answers

Is CVE-2026-13501 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13501 being exploited in the wild.
How severe is CVE-2026-13501?: Medium severity, with a CVSS score of 5.3, published 28 June 2026.
Which products and versions are affected?: ANTLR4 up to 4.13.2.
Is there a fix for CVE-2026-13501?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13501 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-13501?: Check whether you run ANTLR4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in ANTLR4 versions up to 4.13.2 within the GoTarget.java file of the Go code generation target. The issue resides in the GoTarget function's interaction with the 'gofmt' component, where improper neutralization of special elements allows for the execution of arbitrary OS commands. This vulnerability is exploitable by a local attacker with low privileges. While an exploit has been disclosed publicly, the vendor has reportedly not responded to the disclosure, and no official patch is currently confirmed.

Affected products

antlr ANTLR4 up to 4.13.2

Timeline

2026-06-28: disclosed: Public disclosure of the vulnerability and exploit code.
2026-06-28: advisory: NVD and VulDB published advisory details.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.