CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-56389

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to execvp(). When running bison --html on a attacker-provided grammar, this behavior allows execution of an arbitrary program with the privileges of the Bison process. Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b. However, they did not provide vulnerable version range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

Score
6.8 medium
Published
2026-07-29
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
devel/bisonbison3.8.2_2,1unaddressedsunpoet@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>bison</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>GNU Bison allows for an execution of an arbitrary program during HTML
	report generation due to improper handling of grammar-defined
	configuration variables. A grammar file can override the executable
	used for the XML‑to‑HTML transformation step via %define
	tool.xsltproc, which is accepted without restriction and passed
	directly to execvp().
 
When running bison --html on a
	attacker-provided grammar, this behavior allows execution of an
	arbitrary program with the privileges of the Bison
	process.


Maintainers of this project were notified about this
	vulnerability, and fixed the issue in commit
	3169c1e7a2c6acc4c59dfcf8b089896d6881925b. However, they did not
	provide vulnerable version range. Version 3.8.2 was tested and
	confirmed as vulnerable, other versions were not tested but might also
	be vulnerable.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-56389</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-56389</url>
    </references>
    <dates>
      <discovery>2026-07-29</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>