Executive brief
GNU Bison, a widely used tool for generating computer programs from grammar descriptions, contains a flaw in how it handles output file paths. An attacker can provide a specially crafted grammar file that forces Bison to write its output to unintended locations on the computer's filesystem. This could result in the accidental overwriting of important system or user files, potentially leading to data loss or system instability.
Technical details
GNU Bison is vulnerable to a path traversal-style flaw (CWE-73) where grammar directives such as %output and %header allow specifying arbitrary file paths. These directives are accepted without restriction and override caller-supplied command-line options. If a user processes an attacker-supplied grammar file, the Bison process can be forced to write generated files to any writable location on the filesystem, potentially overwriting existing files. The fix, implemented in commit 8d101c19d4d9aaedf83a448c925513742d4efcf0, introduces a check to ensure output filenames do not contain slashes.
Affected products
- GNU Bison 3.8.2
Timeline
- 2026-04-23: patched: Fix committed to master branch
- 2026-07-29: disclosed: Advisory published by CERT.PL