Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A weakness has been identified in antlr ANTLR4 up to 4.13.2. Affected is an unknown function of the file tool/src/org/antlr/v4/codegen/model/OutputFile.java of the component Grammar Action Block Handler. Executing a manipulation can lead to code injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-28 | 1 | Disclosure1 |
| 2026-06-29 | 1 | Patch1 |
| 2026-07-17 | 1 | Disclosure1 |
CVE-2026-13500 Code Injection in ANTLR4 Grammar Action Block Handler Up to 4.13.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-13500
Post summary
The post announces CVE-2026-13500, a code injection vulnerability in ANTLR4 Grammar Action Block Handler up to version 4.13.2, as listed on Vulmon.
🚨High - ANTLR4 Grammar Action Block Code Injection (CVE-2026-13500) A vulnerability in ANTLR4 (up to 4.13.2) exists in the Grammar Action Block Handler (tool/src/org/antlr/v4/codegen/model/OutputFile.java). An attacker can inject malicious code through manipulated grammar action blocks. The exploit is public and can be launched remotely. The vendor was notified but has not responded. 👉Affected: antlr4 <= 4.13.2 Action: Update to a fixed version or apply appropriate input validation when using ANTLR4 for grammar processing.
Post summary
ANTLR4 versions up to 4.13.2 are vulnerable to grammar action block code injection (CVE‑2026‑13500). Users should update to the fixed release or implement input validation to mitigate the risk.
"Any system that accepts .g4 files from untrusted sources and compiles/executes the generated output is fully compromised. The attack requires no special privileges" Replace g4 with java, c or rs and decide if that is also a cve in javac, gcc or rustc #antlr #CVE-2026-13500
Post summary
The text discloses CVE‑2026‑13500 as a remote‑code‑execution vulnerability where untrusted .g4 files can be compiled and executed, compromising the system without special privileges.