The vulnerability resides in the GoTarget function of the gofmt component of ANTLR4. Manipulation of the GoTarget code causes unsanitized data to be embedded into a system command, allowing an attacker to execute arbitrary commands. Because the exploit requires local access to the ANTLR4 environment, it is not exploitable remotely, but a local attacker who can run the ANTLR4 tool can elevate privilege or compromise the host.

The vulnerability affects ANTLR4 releases up to 4.13.2 that include the gofmt tool. No other versions are listed as impacted, and the vendor is antlr:ANTLR4.

The CVSS score of 4.8 indicates moderate severity, but the risk is limited to local attackers. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Because the attack vector is local, the exploitation likelihood depends on an attacker’s ability to run ANTLR4 on the target machine.