CVE-2026-79992

GNU Emacs's TRAMP remote-file-editing layer concatenates login arguments without proper sanitization before passing them to a local shell, so shell metacharacters smuggled in via maliciously crafted (remote) filenames can execute arbitrary commands (CWE-78). A local attacker with a low-privilege account can plant or trick a victim into opening such a crafted filename, and successful exploitation yields arbitrary code execution running as the Emacs user (CVSS 7.8, AV:L/PR:L). TRAMP ships bundled with Emacs, so Emacs installations are the population at risk, though the advisory does not specify affected version ranges; the flaw stems from an incomplete fix for the earlier CVE-2024-53920. Near-term exploitation appears unlikely: EPSS is 0.1% (3rd percentile), there is no public PoC, and the flaw is not in the CISA KEV catalog.

What to do: Upgrade Emacs and the TRAMP package to a release containing the fix for CVE-2026-79992 as soon as it is available from your distribution or GNU ELPA, since this is a follow-up to the earlier CVE-2024-53920 fix. Avoid opening remote file names from untrusted or world-writable locations, and on shared multi-user Linux/Unix hosts check shell histories and TRAMP buffers for unexpected command execution. Exploitation requires an existing local foothold, so single-user workstations are at lower practical risk than shared developer machines.