CVE-2026-13501
antlr ANTLR4 gofmt GoTarget.java GoTarget command injection
A security vulnerability has been detected in antlr ANTLR4 up to 4.13.2. Affected by this vulnerability is the function GoTarget of the file tool/src/org/antlr/v4/codegen/target/GoTarget.java of the component gofmt. The manipulation leads to command injection. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
antlr ANTLR4 gofmt GoTarget.java GoTarget command injection
A security vulnerability has been detected in antlr ANTLR4 up to 4.13.2. Affected by this vulnerability is the function GoTarget of the file tool/src/org/antlr/v4/codegen/target/GoTarget.java of the component gofmt. The manipulation leads to command injection. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
CVE-2026-13501- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R - CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R - CVSS 2.0
- 4.3
AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR - Weakness
- CWE-77, CWE-74
- Updated
- 2026-11-02
EUVDEUVD-2026-39999
A security vulnerability has been detected in antlr ANTLR4 up to 4.13.2. Affected by this vulnerability is the function GoTarget of the file tool/src/org/antlr/v4/codegen/target/GoTarget.java of the component gofmt. The manipulation leads to command injection. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
EUVD-2026-39999- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q226-w36v-hhxv
A security vulnerability has been detected in antlr ANTLR4 up to 4.13.2. Affected by this...
A security vulnerability has been detected in antlr ANTLR4 up to 4.13.2. Affected by this vulnerability is the function GoTarget of the file tool/src/org/antlr/v4/codegen/target/GoTarget.java of the component gofmt. The manipulation leads to command injection. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
GHSA-q226-w36v-hhxv- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-74
- Updated
- 2026-11-02
NVD
A security vulnerability has been detected in antlr ANTLR4 up to 4.13.2. Affected by this vulnerability is the function GoTarget of the file tool/src/org/antlr/v4/codegen/target/GoTarget.java of the component gofmt. The manipulation leads to command injection. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
CVE-2026-13501- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 4.3 Medium
AV:L/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-74, CWE-77
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-13501
A security vulnerability has been detected in antlr ANTLR4 up to 4.13.2. Affected by this vulnerability is the function GoTarget of the file tool/src/org/antlr/v4/codegen/target/GoTarget.java of the component gofmt. The manipulation leads to command injection. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
DEBIAN-CVE-2026-13501- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-13501
A security vulnerability has been detected in antlr ANTLR4 up to 4.13.2. Affected by this vulnerability is the function GoTarget of the file tool/src/org/antlr/v4/codegen/target/GoTarget.java of the component gofmt. The manipulation leads to command injection. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
UBUNTU-CVE-2026-13501- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1791457538 No score
TuxCare security update for org.antlr (3 CVEs)
TuxCare rebuilt 6 org.antlr packages to address 3 CVEs. Fixed in 4.13.0-tuxcare.1.
- Record
CLSA-2026-1791457538- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.antlr:antlr4TuxCare:Maven From an advisory covering 3 CVEs |
4.13.0 up to 4.13.0-tuxcare.1 | 4.13.0-tuxcare.1 |
org.antlr:antlr4-masterTuxCare:Maven From an advisory covering 3 CVEs |
4.13.0 up to 4.13.0-tuxcare.1 | 4.13.0-tuxcare.1 |
org.antlr:antlr4-maven-pluginTuxCare:Maven From an advisory covering 3 CVEs |
4.13.0 up to 4.13.0-tuxcare.1 | 4.13.0-tuxcare.1 |
org.antlr:antlr4-runtimeTuxCare:Maven From an advisory covering 3 CVEs |
4.13.0 up to 4.13.0-tuxcare.1 | 4.13.0-tuxcare.1 |
org.antlr:antlr4-runtime-testsuiteTuxCare:Maven From an advisory covering 3 CVEs |
4.13.0 up to 4.13.0-tuxcare.1 | 4.13.0-tuxcare.1 |
org.antlr:antlr4-tool-testsuiteTuxCare:Maven From an advisory covering 3 CVEs |
4.13.0 up to 4.13.0-tuxcare.1 | 4.13.0-tuxcare.1 |
antlr4Debian:12 |
All versions, plus listed versions 4.7.2-54.9.2-14.9.2-24.9.2-3 |
None known |
antlr4Debian:13 |
All versions, plus listed versions 4.9.2-3 |
None known |
antlr4Debian:14 |
All versions, plus listed versions 4.9.2-3 |
None known |
antlr4Ubuntu:16.04:LTS |
All versions, plus listed versions 4.5.1-14.5.1-2 |
None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
antlr4Ubuntu:18.04:LTS |
All versions, plus listed versions 4.5.3-24.7.2-1~18.04 |
None known |
antlr4Ubuntu:20.04:LTS |
All versions, plus listed versions 4.7.2-14.7.2-2 |
None known |
antlr4Ubuntu:22.04:LTS |
All versions, plus listed versions 4.7.2-5 |
None known |
antlr4Ubuntu:24.04:LTS |
All versions, plus listed versions 4.7.2-54.9.2-2 |
None known |
antlr4Ubuntu:25.10 |
All versions, plus listed versions 4.9.2-3 |
None known |
antlr4Ubuntu:26.10 |
All versions, plus listed versions 4.9.2-3build1 |
None known |
antlr4Ubuntu:26.04:LTS |
All versions, plus listed versions 4.9.2-34.9.2-3build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-13501 is a medium vulnerability (CVSS 4.8) in Antlr Antlr4, published June 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.41%, the 72nd percentile. No source names a fixed version.