Vulnerability · Published Jun 28, 2026 · Assigned by VulDB
CVE-2026-13500antlr ANTLR4 Grammar Action Block OutputFile.java code injection
High 7.3
In plain English
A high-severity code injection in ANTLR4 from antlr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Official description
A weakness has been identified in antlr ANTLR4 up to 4.13.2. Affected is an unknown function of the file tool/src/org/antlr/v4/codegen/model/OutputFile.java of the component Grammar Action Block Handler. Executing a manipulation can lead to code injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | antlr4 | no fix listed | DEBIAN-CVE-2026-13500 |
| Debian:13 | antlr4 | no fix listed | DEBIAN-CVE-2026-13500 |
| Debian:14 | antlr4 | no fix listed | DEBIAN-CVE-2026-13500 |
| Ubuntu:22.04:LTS | antlr4 | no fix listed | UBUNTU-CVE-2026-13500 |
| Ubuntu:24.04:LTS | antlr4 | no fix listed | UBUNTU-CVE-2026-13500 |
| Ubuntu:25.10 | antlr4 | no fix listed | UBUNTU-CVE-2026-13500 |
| Ubuntu:26.04:LTS | antlr4 | no fix listed | UBUNTU-CVE-2026-13500 |
| Ubuntu:26.10 | antlr4 | no fix listed | UBUNTU-CVE-2026-13500 |
Affected products (as reported)
Weakness: CWE-94, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-374495 | antlr ANTLR4 Grammar Action Block OutputFile.java code injection vdb-entry
- VDB-374495 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-13500 | CVE Analysis and Report third-party-advisory
- Submit #838568 | antlr ANTLR4 4.13.2 Code Injection third-party-advisory
- https://github.com/wooyun123/wooyun/issues/4 exploit, issue-tracking