CVE-2023-28617: OS Command Injection
Last updated 27 March 2025
Other sources
org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/emacsto a version that resolves this vulnerability.Fixed in 1:27.1+1-3.1+deb11u6Fixed in 1:28.2+1-15+deb12u4Fixed in 1:30.1+1-5 - Upgrade
Upgrade
debian/org-modeto a version that resolves this vulnerability.Fixed in 9.4.0+dfsg-1+deb11u3Fixed in 9.5.2+dfsh-5Fixed in 9.7.27+dfsg-1
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-28617.
What is the severity of CVE-2023-28617?
The severity of CVE-2023-28617 is high with a CVSS score of 7.8.
Which software is affected by CVE-2023-28617?
Org Mode through version 9.6.1 for GNU Emacs is affected by CVE-2023-28617.
How can attackers exploit CVE-2023-28617?
Attackers can exploit CVE-2023-28617 by executing arbitrary commands through a file or directory name that contains shell metacharacters.
Is there a fix available for CVE-2023-28617?
Yes, there are fixes available for CVE-2023-28617. Please refer to the provided references for more information.