Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the HTML report generation process due to improper handling of grammar-defined configuration variables. An attacker can execute arbitrary programs with the privileges of the process by supplying a crafted grammar fi...

AZL-94133 CVE-2026-56389 affecting package bison for versions less than 3.8.2-2

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...

CVE-2026-56389

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...

CVE-2026-56389: Improper Neutralization of Special Elements used in an OS Command

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...