GNU Bison improperly neutralizes special elements used in an OS command during HTML report generation. Specifically, the %define tool.xsltproc configuration variable in a grammar file can override the executable used for the XML-to-HTML transformation step. This value is passed directly to execvp() without validation, enabling an attacker to execute arbitrary commands with the privileges of the Bison process when running 'bison --html' on a malicious grammar file. The vulnerability was fixed in commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b, but the vendor did not specify the affected version range. Version 3.8.2 is confirmed vulnerable.

An attacker who can supply a malicious grammar file to the 'bison --html' command can execute arbitrary code with the privileges of the Bison process. This could lead to unauthorized code execution on the host system. The vulnerability requires local access or the ability to run Bison with attacker-controlled input. The CVSS 4.0 score is 6.8 (medium severity), reflecting the need for user interaction and local access but with high impact on confidentiality and integrity.

A fix for this vulnerability exists in the form of commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b. However, the vendor has not provided an official patched version number. Users should update Bison to the latest version that includes this commit once it is officially released. Until then, avoid running 'bison --html' on untrusted grammar files to prevent exploitation.