Emacs arbitrary code execution: incomplete fix for CVE-2024-53920
Incomplete fix for Emacs CVE-2024-53920 allows arbitrary code execution when viewing or editing untrusted files in non-Lisp modes like Perl flymake.
52
CVE-2024-53920
- CVSS 3.1
- 7.8 high
- EPSS
- <1%p48
- Published
- ·
- Modified
Description · NVD
In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)
In the news
4 storiesRe: Emacs arbitrary code execution: incomplete fix for CVE-2024-53920
CVE-2026-96442 was assigned for an incomplete Emacs fix of arbitrary code execution CVE-2024-53920.
47
Re: Emacs arbitrary code execution: incomplete fix for CVE-2024-53920
Bas Alberts asks Red Hat to assign a CVE for an incomplete Emacs fix of CVE-2024-53920.
42
Re: Emacs arbitrary code execution: incomplete fix for CVE-2024-53920
Tomas Hoger asks oss-security whether GitHub or Red Hat will assign a CVE for Emacs's incomplete fix of arbitrary code execution bug CVE-2024-53920.
12