Re: Incomplete fix for Emacs CVE-2026-79992
Salvatore Bonaccorso flags CVE-2026-108976 as an incomplete fix for Emacs CVE-2026-79992.
24
CVE-2026-108976
OS command injection in GNU Emacs and TRAMP via filename
- CVSS 3.1
- 7.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
GNU Emacs before 31.2, and the TRAMP remote-file package through 2.8.2, allow operating-system command injection via a filename. The flaw is an incomplete list of disallowed inputs in tramp-user-regexp (CWE-184) and exists because of an incomplete fix for CVE-2026-79992. A local attacker with low privileges and no user interaction can cause the Emacs process to run arbitrary OS commands, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 7.8). Anyone running an affected Emacs build or a standalone TRAMP install through 2.8.2 is affected. No public proof of concept is known, and the issue is not in CISA's Known Exploited Vulnerabilities catalog.
What to do: Upgrade GNU Emacs to 31.2 or later and upgrade TRAMP to a release newer than 2.8.2. Until those versions are installed, do not open or visit untrusted filenames through TRAMP, particularly from local accounts that should not be able to run commands as the Emacs user. Check the running Emacs version and the installed TRAMP version after updating.
| Product | Affected |
|---|---|
| GNU Emacs | before 31.2 |
| GNU TRAMP | through 2.8.2 |
Estimated exposure
largehundreds of thousands to low millions of installations (order-of-magnitude estimate) — Emacs with bundled TRAMP is a standard package on most Unix-like distributions and is widely used by developers and on servers; there is no vendor install census or public scan count, so this is an order-of-magnitude estimate from that…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.
- Weakness
- CWE-184
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H