GNU Bison can execute an arbitrary program when generating HTML reports because a grammar file may override the XML‑to‑HTML tool via %define tool.xsltproc. The parameter is accepted without validation and directly passed to execvp(), a classic example of CWE‑78, leading to potential remote or local command execution with the privileges of the Bison process.

The vulnerability affects GNU Bison, with version 3.8.2 confirmed as vulnerable and other pre‑patch releases potentially affected. The issue was addressed in the commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b, but a precise version range is not documented.

The CVSS score is 6.8, indicating moderate severity, while the EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by supplying a malicious grammar file and running bison --html; the unvalidated tool definition causes the program to execute arbitrary binaries with the Bison process’ rights. The risk is heightened in environments where Bison runs as root or with elevated privileges, but it remains limited to the scope of the Bison invocation. The description does not explicitly state that this can be leveraged remotely or locally; this inference is based on the use of execvp() and the fact that arbitrary binaries are invoked with the process’s privileges.