Re: Emacs arbitrary code execution: incomplete fix for CVE-2024-53920

In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)

GNU Emacs's TRAMP remote-file-editing layer concatenates login arguments without proper sanitization before passing them to a local shell, so shell metacharacters smuggled in via maliciously crafted (remote) filenames can execute arbitrary commands (CWE-78). A local attacker with a low-privilege account can plant or trick a victim into opening such a crafted filename, and successful exploitation yields arbitrary code execution running as the Emacs user (CVSS 7.8, AV:L/PR:L). TRAMP ships bundled with Emacs, so Emacs installations are the population at risk, though the advisory does not specify affected version ranges; the flaw stems from an incomplete fix for the earlier CVE-2024-53920. Near-term exploitation appears unlikely: EPSS is 0.1% (3rd percentile), there is no public PoC, and the flaw is not in the CISA KEV catalog.

Do: Upgrade Emacs and the TRAMP package to a release containing the fix for CVE-2026-79992 as soon as it is available from your distribution or GNU ELPA, since this is a follow-up to the earlier CVE-2024-53920 fix. Avoid opening remote file names from untrusted or world-writable locations, and on shared multi-user Linux/Unix hosts check shell histories and TRAMP buffers for unexpected command execution. Exploitation requires an existing local foothold, so single-user workstations are at lower practical risk than shared developer machines.