Re: Emacs arbitrary code execution: incomplete fix for CVE-2024-53920

In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)

A code execution vulnerability exists in GNU Emacs versions prior to 31.2. The flaw is triggered when the Flymake mode performs syntax checking using a language backend other than Lisp, causing it to execute arbitrary code from the currently open file. This allows an attacker to achieve arbitrary code execution with the privileges of the user running Emacs by luring them into viewing or editing a malicious file. No public proof-of-concept or exploitation in the wild has been reported at this time. The vulnerability is rated as high severity.

Do: Upgrade to Emacs version 31.2 or later immediately. If upgrading is not immediately possible, disable Flymake mode or ensure you only open trusted files.