7.8
High
CVE-2026-108976 GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has…
Description
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Emacs 31.2 | earliest → < 31.2 | 31.2 |
References
- ftp.gnu.org ftp.gnu.org
- www.openwall.com www.openwall.com
- www.openwall.com www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Emacs
The 9 CVEs of Emacs →
CVE-2026-96269
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of…
7.5
High
CVE-2026-77219
GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak…
6.9
Medium
CVE-2026-71394
GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c
5.3
Medium
CVE-2026-71393
GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c
5.3
Medium