CVE-2026-13501 is a command injection vulnerability found in the GoTarget function within the gofmt component of antlr ANTLR4 versions 4.13.0 through 4.13.2. The vulnerability requires local access to exploit and allows an attacker to execute arbitrary commands on the affected system. The vulnerability was publicly disclosed without vendor response or an available patch at the time of publication.

An attacker with local access can exploit this vulnerability to execute arbitrary commands on the affected system, potentially leading to unauthorized actions or system compromise. The impact is limited by the requirement for local access and the absence of user interaction.

No official fix or patch is currently available from the vendor. Users should restrict local access to trusted users only and monitor for suspicious activity. Check the vendor advisory regularly for updates or patches addressing this vulnerability.