CVE-2026-13503

Path Traversal in ANTLR4 tokenVocab Grammar Option Handler

FALSE POSITIVE

Rundeck and Runbook Automation are not vulnerable to this CVE.

CVE-2026-13503 describes a path traversal vulnerability (CWE-22) in the getImportedVocabFile function of tool/src/org/antlr/v4/parse/TokenVocabParser.java, which handles the tokenVocab grammar option. It affects ANTLR4 versions 4.13.0 through 4.13.2. Exploitation requires the ANTLR4 tool (the grammar-to-code generator) to process an attacker-controlled .g4 grammar file whose tokenVocab option references a path outside the intended vocabulary directory, potentially allowing an unintended file to be read during code generation.

The ANTLR4 maintainers have reviewed this report in antlr/antlr4#4952 and confirmed the practical risk is close to null, since the ANTLR tool is intended to be run locally against trusted, developer-authored grammars rather than exposed to untrusted input or invoked remotely. They do not plan to release a fix.

Rundeck and Runbook Automation only depend on antlr4-runtime, pulled in transitively through Apache Groovy (which uses ANTLR4 internally to parse the Groovy language grammar). Neither product bundles or invokes the antlr4 code-generation tool itself, and neither accepts externally supplied .g4 grammar files or runs ANTLR4 code generation against untrusted input as part of any user-facing feature or pipeline. Since the vulnerable code path only exists in the tool's grammar-import handling and requires processing an attacker-supplied grammar at generation time, this vulnerability does not impact our products.