CVE-2026-13501: ANTLR4 Command Injection RCE Vulnerability

CVE-2026-13501 Overview

CVE-2026-13501 is a command injection vulnerability [CWE-74] in the ANTLR4 parser generator through version 4.13.2. The flaw resides in the GoTarget function of tool/src/org/antlr/v4/codegen/target/GoTarget.java, which invokes the gofmt component during Go code generation. Attacker-controlled input passed to the formatter enables command injection during local build operations. The vendor was contacted prior to public disclosure but did not respond. The exploit technique has been disclosed publicly.

Critical Impact
Local attackers with low privileges can inject arbitrary commands through the ANTLR4 Go code generation pipeline, resulting in limited impact to confidentiality, integrity, and availability of the developer environment.

Affected Products

ANTLR ANTLR4 versions up to and including 4.13.2
tool/src/org/antlr/v4/codegen/target/GoTarget.java component
gofmt invocation path within the Go target code generator

Discovery Timeline

2026-06-28 - CVE-2026-13501 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13501

Vulnerability Analysis

The vulnerability exists within the ANTLR4 tool chain, specifically in the Go language target. When ANTLR4 generates Go parser code, the GoTarget class invokes the external gofmt utility to format the generated output. The invocation path constructs a command string that incorporates values derived from grammar or file inputs without sufficient sanitization. This behavior allows an operator of the ANTLR4 tool to influence the executed command line.

The issue is classified under [CWE-74], improper neutralization of special elements in output used by a downstream component. Because the attack surface is restricted to a local environment and requires the attacker to already have low privileges to run the ANTLR4 tool, exploitation is bounded in scope. The impact remains limited to the account executing the build.

Root Cause

The root cause is unsanitized concatenation of externally influenced values into the arguments passed to gofmt inside GoTarget.java. Metacharacters interpreted by the shell or process launcher are not neutralized before command execution, enabling injection of additional operations alongside the intended formatting call.

Attack Vector

Exploitation requires local access and the ability to supply a crafted grammar file or file path processed by ANTLR4 with the Go target enabled. When the tool proceeds to invoke gofmt, injected payloads execute in the context of the user running ANTLR4. See the VulDB Vulnerability Details and the GitHub Issue Report for public technical references. No verified proof-of-concept code has been reproduced here.

Detection Methods for CVE-2026-13501

Indicators of Compromise

Unexpected child processes spawned by the Java process running ANTLR4, particularly shells or interpreters descending from gofmt invocations.
Grammar files (.g4) or Go target configurations containing shell metacharacters such as backticks, ;, &&, |, or $() in file paths or option values.
Modifications to developer workstation artifacts (SSH keys, shell profiles, CI credentials) coinciding with ANTLR4 build runs.

Detection Strategies

Audit build logs from ANTLR4 tool executions for anomalous gofmt command lines that include arguments beyond a single Go source file path.
Instrument endpoint process telemetry to flag java process trees that spawn non-gofmt binaries during code generation steps.
Static-scan grammar inputs and build scripts for suspicious characters in filenames or target options prior to invoking ANTLR4.

Monitoring Recommendations

Enable command-line auditing on developer workstations and CI runners that execute ANTLR4 with the Go target.
Alert on process-lineage anomalies where gofmt or its parent java process launches unrelated system utilities.
Track versions of ANTLR4 in use across development environments and flag installations at or below 4.13.2.

How to Mitigate CVE-2026-13501

Immediate Actions Required

Restrict execution of ANTLR4 with the Go target to trusted grammar inputs and vetted file paths.
Run ANTLR4 code generation inside isolated build containers or ephemeral CI runners with minimal privileges and no access to sensitive credentials.
Review recent Go code generation runs for evidence of injected commands or unexpected process activity.

Patch Information

At the time of publication, the ANTLR maintainers had not responded to the disclosure and no vendor-supplied patch was referenced in the advisory. Monitor the VulDB entry for CVE-2026-13501 and the upstream ANTLR project for future fixes to GoTarget.java.

Workarounds

Avoid using the Go target of ANTLR4 on untrusted grammar files or file paths sourced from external contributors.
Sanitize filenames and target arguments passed to ANTLR4 to exclude shell metacharacters before invoking the tool.
Wrap gofmt on affected build systems with a controlled shim that validates arguments and rejects unexpected tokens.

bash

# Configuration example: isolate ANTLR4 Go code generation in a restricted container
docker run --rm \
  --network=none \
  --read-only \
  --tmpfs /tmp \
  -v "$(pwd)/grammars:/work/grammars:ro" \
  -v "$(pwd)/out:/work/out" \
  -w /work \
  antlr/antlr4:pinned \
  -Dlanguage=Go -o /work/out /work/grammars/MyGrammar.g4