CVE-2026-13500 is a code injection vulnerability affecting antlr ANTLR4 versions 4.13.0, 4.13.1, and 4.13.2. The issue resides in an unspecified function within the Grammar Action Block Handler component, specifically in the file tool/src/org/antlr/v4/codegen/model/OutputFile.java. An attacker can remotely manipulate this function to inject and execute arbitrary code. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and limited impact on confidentiality, integrity, and availability. Public exploit code exists, but no vendor response or patch has been provided as of the publication date.

Successful exploitation of this vulnerability allows remote code injection, potentially enabling an attacker to execute arbitrary code on the affected system without requiring authentication or user interaction. This can compromise the confidentiality, integrity, and availability of the system running the vulnerable ANTLR4 versions. The presence of public exploit code increases the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider avoiding or restricting use of affected versions 4.13.0, 4.13.1, and 4.13.2 until a patch or official mitigation is released. Monitor official vendor channels for updates.