Xvada: New Grammar Inference Tool Finds CVE in Python Liquid Engine
A novel technique infers accurate grammars at scale, uncovering 6 bugs in a popular Python library.
Black-box context-free grammar inference is essential for program analysis, reverse engineering, and fuzzing, but existing tools like Arvada, TreeVada, Kedavra, and Cucio struggle with large languages. In a new paper on arXiv (July 2026), researchers Mohammad Rifat Arefin, Nuhiat Arefin, Shanto Rahman, and Christoph Csallner introduce Xvada, which uses novel deterministic inference techniques. In empirical comparisons that avoid pitfalls of prior studies, Xvada improves accuracy and grammar compactness over TreeVada, the previous state-of-the-art. This advancement makes grammar inference practical for 'big languages,' enabling more reliable reverse engineering and vulnerability discovery.
Xvada's real-world impact is immediate: it found a CVE in the widely used Python Liquid template engine. Subsequent fuzzing based on Xvada-inferred grammars uncovered five additional bugs, all confirmed and fixed by the Liquid developers. The tool and all experimental data and scripts are freely available. For security researchers and developers, Xvada offers a scalable path to infer grammars from black-box code, improving fuzzing coverage and uncovering hidden vulnerabilities in large software systems.
- Xvada outperforms TreeVada in both grammar accuracy and compactness on large-language benchmarks.
- The tool discovered a CVE in the Python Liquid template engine, highlighting its security value.
- Fuzzing with Xvada-inferred grammars revealed 5 additional bugs, all fixed by the Liquid maintainers.
Why It Matters
Xvada makes grammar inference scalable and practical for large codebases, boosting security, reverse engineering, and fuzzing for developers.