CVE-2026-13501

Command Injection in ANTLR4 Go Target (gofmt)

FALSE POSITIVE

Rundeck and Runbook Automation are not vulnerable to this CVE.

CVE-2026-13501 describes a command injection vulnerability (CWE-77 / CWE-74) in tool/src/org/antlr/v4/codegen/target/GoTarget.java, the ANTLR4 code generator's target for the Go programming language, which shells out to the gofmt binary. It affects ANTLR4 versions 4.13.0 through 4.13.2. The attack can only be performed locally, and requires the ANTLR4 tool to be run with the Go target against attacker-controlled input.

The ANTLR4 maintainers have reviewed this report in antlr/antlr4#4952 and confirmed the vulnerability generally has no impact for ordinary use, since the tool is normally run locally by a developer rather than exposed remotely or in a pipeline processing untrusted grammars. They do not plan to release a fix.

Rundeck and Runbook Automation only depend on antlr4-runtime, pulled in transitively through Apache Groovy (which uses ANTLR4 internally to parse the Groovy language grammar). Neither product bundles or invokes the antlr4 code-generation tool, and neither generates code using ANTLR4's Go target — both products are JVM/Java applications and have no use for Go code generation or gofmt. Since the vulnerable code path only exists in a code-generation target our products never invoke, this vulnerability does not impact our products.