As cited
Copy frozen at (site build).
vulnerabilities
Emacs arbitrary code execution: incomplete fix for CVE-2024-53920
The fix for CVE-2024-53920, an arbitrary code execution vulnerability in Emacs, was found to be incomplete. An attacker can still achieve code execution by embedding malicious code in untrusted text files using non-Lisp mode declarations, such as Perl mode with embedded shell commands. The vulnerability affects multiple Emacs versions previously thought to be patched.
Why it matters: Emacs users who open untrusted files remain at risk of arbitrary code execution despite the initial CVE-2024-53920 patch; practitioners should verify whether updated fixes are available and reinforce safe file handling practices.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Emacs arbitrary code execution: incomplete fix for CVE-2024-53920
Bas Alberts of the GitHub Security Lab identified that the fix for CVE-2024-53920, an arbitrary code execution vulnerability in Emacs, does not fully prevent code execution when viewing or editing untrusted text files in non-Lisp modes. The vulnerability allows attackers to execute arbitrary commands through specially crafted files that exploit mode-specific parsing, as demonstrated in a Perl file example with embedded shell execution.
Why it matters: Emacs users who open untrusted files remain at risk of arbitrary code execution despite the CVE-2024-53920 patch; practitioners should assess whether their organizations use Emacs with untrusted content and consider additional mitigations or updated fixes.
- Source published
- First seen by Cybersecurity Tracker