CVE-2026-56389 describes a command injection vulnerability in GNU Bison's HTML report generation feature. The vulnerability arises because the %define tool.xsltproc grammar directive can specify an arbitrary executable for the XML-to-HTML transformation step. This value is passed directly to execvp() without validation, allowing an attacker to execute arbitrary programs with the privileges of the Bison process. The vulnerability was reported to maintainers and fixed in a specific commit, but the exact affected version range is not clearly defined. Version 3.8.2 is confirmed vulnerable; other versions, including 3.0, may also be affected.

An attacker who can supply a malicious grammar file and run bison with the --html option can execute arbitrary code with the privileges of the Bison process. This can lead to full compromise of the affected system depending on the privileges of the user running Bison. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector. No known exploits in the wild have been reported.

A fix for this vulnerability has been committed by the maintainers. Users should update to a version that includes the fix once it is officially released. Until then, avoid running bison --html on untrusted grammar files to prevent arbitrary code execution. Monitor the official GNU Bison project for updated releases and advisories.