Threat Intelligence / CVE / CVE-2026-13503

CVE-2026-13503

CVSS 5.3 (MEDIUM) · EPSS 0.5% · Priority 4.3/10 · Published 2026-06-28

As of 2026-06-29, CVE-2026-13503 is a CVSS 5.3 (MEDIUM-severity) vulnerability. EPSS exploitation probability 0.5%. Threadlinqs Intelligence tracks 0 threats exploiting it.

Last updated: 2026-06-29

A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function getImportedVocabFile of the file tool/src/org/antlr/v4/parse/TokenVocabParser.java of the component tokenVocab Grammar Option Handler. The manipulation results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

Weaknesses (CWE)

CWE-22

References

Full detection coverage & IOCs for threats exploiting CVE-2026-13503 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.