Emacs 31.1 .dir-locals.el flaw can run arbitrary code
Original title: Emacs .dir-locals.el arbitrary code execution
X3r0Day reported inadequate validation; the oss-security post includes only a truncated files.el diff.
Sean Whitton posted to oss-security that X3r0Day found Emacs 31.1 did not adequately validate .dir-locals.el, allowing arbitrary code execution. The message points to a GNU debbugs report and a Stefan Monnier change in lisp/files.el, but the feed text is cut off. No fixed release or exploitation is stated.
Unconfirmed: The snippet is truncated, so the fixed version and full validation failure are not stated.
- The affected version named in the post is Emacs 31.1.
- The change shown is in lisp/files.el.
- The report links to GNU debbugs 82213.
Impact: arbitrary code execution via directory-local settings
| Product | Affected |
|---|---|
| GNU Emacs | 31.1 |
From the original article
Posted by Sean Whitton on Nov 11 X3r0Day discovered that Emacs 31. 1 did not adequately validate the https://debbugs. gnu.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.