GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to execvp(). When running bison --html on a attacker-provided grammar, this behavior allows execution of an arbitrary program with the privileges of the Bison process. Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 3169c1e7a2c6acc4c59dfcf8b089896d6881925b. However, they did not provide vulnerable version range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

According to the versions of the bison packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A vulnerability was found in GNU Bison (affected version not known) and classified as critical. Affected     by this issue is the function execvp of the component HTML Report Generation. Applying the patch     3169c1e7a2c6acc4c59dfcf8b089896d6881925b is able to eliminate this problem.(CVE-2026-56389)

    GNU Bison improperly handles grammardefined output paths. Grammar directives such as %output and     %header allow specifying file paths, which are accepted without restriction and override callersupplied     output options. When processing attacker-supplied grammar, this behavior allows directing generated files     to arbitrary writable locations on the filesystem, potentially overwriting existing files accessible to     the Bison process. Maintainers of this project were notified about this vulnerability, and fixed the issue     in commit 8d101c19d4d9aaedf83a448c925513742d4efcf0. However, they did not provide vulnerable version     range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also     be vulnerable.(CVE-2026-56390)

Tenable has extracted the preceding description block directly from the EulerOS bison security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8777-1 advisory.

    It was discovered that GNU Bison incorrectly handled grammar-defined configuration variables when     generating HTML reports. An attacker could possibly use this issue to execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper     handling of grammar-defined configuration variables. A grammar file can override the executable used for     the XMLtoHTML transformation step via %define tool.xsltproc, which is accepted without restriction and     passed directly to execvp(). When running bison --html on a attacker-provided grammar, this behavior     allows execution of an arbitrary program with the privileges of the Bison process. Maintainers of this     project were notified about this vulnerability, and fixed the issue in commit     3169c1e7a2c6acc4c59dfcf8b089896d6881925b. However, they did not provide vulnerable version range. Version     3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
    (CVE-2026-56389)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365044	EulerOS 2.0 SP11 : bison (EulerOS-SA-2026-4305)	Nessus	Huawei Local Security Checks	Local	medium
364881	EulerOS 2.0 SP11 : bison (EulerOS-SA-2026-4214)	Nessus	Huawei Local Security Checks	Local	medium
364792	EulerOS 2.0 SP13 : bison (EulerOS-SA-2026-4123)	Nessus	Huawei Local Security Checks	Local	medium
364787	EulerOS 2.0 SP13 : bison (EulerOS-SA-2026-4032)	Nessus	Huawei Local Security Checks	Local	medium
350308	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : GNU Bison vulnerability (USN-8777-1)	Nessus	Ubuntu Local Security Checks	Local	medium
330722	Linux Distros Unpatched Vulnerability : CVE-2026-56389	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-56389

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium