CVE-2026-13500

Code Injection in ANTLR4 Grammar Action Block Handler

FALSE POSITIVE

Rundeck and Runbook Automation are not vulnerable to this CVE.

CVE-2026-13500 describes a code injection vulnerability (CWE-94) in tool/src/org/antlr/v4/codegen/model/OutputFile.java, part of the ANTLR4 grammar compiler's action block handling. It affects ANTLR4 versions 4.13.0 through 4.13.2. Exploitation requires the ANTLR4 tool (the grammar-to-code generator) to process an attacker-controlled .g4 grammar file containing malicious action code, and for the resulting generated source to then be compiled and executed.

The ANTLR4 maintainers have reviewed this report in antlr/antlr4#4952 and confirmed that the practical risk is close to null, since the ANTLR tool is designed to be run locally by a developer against trusted grammars, not exposed to untrusted input or invoked remotely. They have stated they cannot fix the issue without breaking a core feature of the tool (the ability for grammars to embed target-language action code), and do not plan to release a patch.

Rundeck and Runbook Automation only depend on antlr4-runtime, pulled in transitively through Apache Groovy (which uses ANTLR4 internally to parse the Groovy language grammar). Neither product bundles or invokes the antlr4 code-generation tool itself, and neither accepts externally supplied .g4 grammar files or runs ANTLR4 code generation as part of any user-facing feature or pipeline. Since the vulnerable code path only exists in the tool's code generator and requires attacker-supplied grammars to be compiled and run, this vulnerability does not impact our products.