Emacs
Products
5- 9 CVEs
- 2 CVEs
- 1 CVE
- 1 CVE
- 1 CVE
Recent CVEs
13| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-39331 | Cri | 0.64 | 9.8 | 0.01 | Jun 23, 2024 | In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5. | ||
| CVE-2026-79992 | Hig | 0.51 | 7.8 | 0.00 | Aug 25, 2026 | A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation… | ||
| CVE-2023-27986 | Hig | 0.51 | 7.8 | 0.00 | Mar 9, 2023 | emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. It is fixed in 29.0.90. | ||
| CVE-2023-27985 | Hig | 0.51 | 7.8 | 0.01 | Mar 9, 2023 | emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90 | ||
| CVE-2024-30205 | Hig | 0.46 | 7.1 | 0.00 | Mar 25, 2024 | In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23. | ||
| CVE-2024-30203 | Med | 0.36 | 5.5 | 0.01 | Mar 25, 2024 | In Emacs before 29.3, Gnus treats inline MIME contents as trusted. | ||
| CVE-2026-71394 | Med | 0.34 | — | 0.00 | Aug 10, 2026 | GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes… | ||
| CVE-2024-30204 | Low | 0.18 | 2.8 | 0.00 | Mar 25, 2024 | In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments. | ||
| CVE-2008-4952 | 0.00 | — | 0.00 | Nov 5, 2008 | emacs-jabber in emacs-jabber 0.7.91 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/*.log temporary file. | |||
| CVE-2008-1694 | 0.00 | — | 0.00 | Apr 22, 2008 | vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary files via a symlink attack on temporary files. | |||
| CVE-2007-5377 | 0.00 | — | 0.00 | Oct 12, 2007 | The (1) tramp-make-temp-file and (2) tramp-make-tramp-temp-file functions in Tramp 2.1.10 extension for Emacs, and possibly earlier 2.1.x versions, allows local users to overwrite arbitrary files via a symlink attack on temporary files. | |||
| CVE-2005-0100 | 0.00 | — | 0.04 | Feb 7, 2005 | Format string vulnerability in the movemail utility in (1) Emacs 20.x, 21.3, and possibly other versions, and (2) XEmacs 21.4 and earlier, allows remote malicious POP3 servers to execute arbitrary code via crafted packets. | |||
| CVE-2000-0270 | 0.00 | — | 0.00 | Apr 18, 2000 | The make-temp-name Lisp function in Emacs 20 creates temporary files with predictable names, which allows attackers to conduct a symlink attack. |
- risk 0.64cvss 9.8epss 0.01
In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.
- risk 0.51cvss 7.8epss 0.00
A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation…
- risk 0.51cvss 7.8epss 0.00
emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. It is fixed in 29.0.90.
- risk 0.51cvss 7.8epss 0.01
emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90
- risk 0.46cvss 7.1epss 0.00
In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23.
- risk 0.36cvss 5.5epss 0.01
In Emacs before 29.3, Gnus treats inline MIME contents as trusted.
- risk 0.34cvss —epss 0.00
GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes…
- risk 0.18cvss 2.8epss 0.00
In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments.
- CVE-2008-4952Nov 5, 2008risk 0.00cvss —epss 0.00
emacs-jabber in emacs-jabber 0.7.91 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/*.log temporary file.
- CVE-2008-1694Apr 22, 2008risk 0.00cvss —epss 0.00
vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary files via a symlink attack on temporary files.
- CVE-2007-5377Oct 12, 2007risk 0.00cvss —epss 0.00
The (1) tramp-make-temp-file and (2) tramp-make-tramp-temp-file functions in Tramp 2.1.10 extension for Emacs, and possibly earlier 2.1.x versions, allows local users to overwrite arbitrary files via a symlink attack on temporary files.
- CVE-2005-0100Feb 7, 2005risk 0.00cvss —epss 0.04
Format string vulnerability in the movemail utility in (1) Emacs 20.x, 21.3, and possibly other versions, and (2) XEmacs 21.4 and earlier, allows remote malicious POP3 servers to execute arbitrary code via crafted packets.
- CVE-2000-0270Apr 18, 2000risk 0.00cvss —epss 0.00
The make-temp-name Lisp function in Emacs 20 creates temporary files with predictable names, which allows attackers to conduct a symlink attack.