CVE-2024-30202: Code Injection

Q: What is the severity of CVE-2024-30202?

CVE-2024-30202 has not been assigned a specific severity rating, but it allows for arbitrary code execution in vulnerable versions of Emacs and Org Mode.

Q: How do I fix CVE-2024-30202?

To fix CVE-2024-30202, upgrade Emacs to version 29.3 or higher and Org Mode to version 9.6.23 or higher.

Q: What versions are affected by CVE-2024-30202?

CVE-2024-30202 affects GNU Emacs versions before 29.3 and GNU Org Mode versions before 9.6.23.

Q: What type of vulnerability is CVE-2024-30202?

CVE-2024-30202 is a code execution vulnerability caused by evaluating arbitrary Lisp code in Emacs when Org mode is enabled.

Q: Who is impacted by CVE-2024-30202?

Users of GNU Emacs and Org Mode prior to the specified versions are at risk due to CVE-2024-30202.

Published Mar 25, 2024

Updated

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.

Affected Software

12 affected componentsFixes available

GNU Emacs<29.3

GNU Org mode<9.6.23

GNU Emacs<29.3

GNU Org Mode Gnu Emacs<9.6.23

debian/emacs<1:28.2+1-15+deb12u1

1:28.2+1-15+deb12u1

debian/emacs<1:29.3+1-1

1:29.3+1-1

debian/emacs<1:29.3+1-1

1:29.3+1-1

debian/org-mode*

debian/org-mode<9.6.23+dfsg-1

9.6.23+dfsg-1

debian/org-mode<9.6.23+dfsg-1

9.6.23+dfsg-1

debian/emacs

1:28.2+1-15+deb12u41:30.1+1-6+deb13u11:30.2+1-11

debian/org-mode<=9.5.2+dfsh-5

9.7.29+dfsg-19.8.12+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/emacs to a version that resolves this vulnerability.
Fixed in 1:28.2+1-15+deb12u1
Upgrade
Upgrade debian/emacs to a version that resolves this vulnerability.
Fixed in 1:29.3+1-1
Upgrade
Upgrade debian/org-mode to a version that resolves this vulnerability.
Fixed in 9.6.23+dfsg-1
Upgrade
Upgrade debian/emacs to a version that resolves this vulnerability.
Fixed in 1:28.2+1-15+deb12u4Fixed in 1:30.1+1-6+deb13u1Fixed in 1:30.2+1-11
Upgrade
Upgrade debian/org-mode to a version that resolves this vulnerability.
Fixed in 9.7.29+dfsg-1Fixed in 9.8.12+dfsg-1
Upgrade
Upgrade Emacs to a version that resolves this vulnerability.
Fixed in 29.3
Upgrade
Upgrade Org Mode to a version that resolves this vulnerability.
Fixed in 9.6.23

Event History

Mar 25, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via OSV·12:00 AM

DescriptionSeverity

Data Sourced

via NVD·03:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Nov 2, 2026

Data Sourced

via OSV·12:02 PM

Affected Software

Frequently Asked Questions

What is the severity of CVE-2024-30202?

CVE-2024-30202 has not been assigned a specific severity rating, but it allows for arbitrary code execution in vulnerable versions of Emacs and Org Mode.

How do I fix CVE-2024-30202?

To fix CVE-2024-30202, upgrade Emacs to version 29.3 or higher and Org Mode to version 9.6.23 or higher.

What versions are affected by CVE-2024-30202?

CVE-2024-30202 affects GNU Emacs versions before 29.3 and GNU Org Mode versions before 9.6.23.

What type of vulnerability is CVE-2024-30202?

CVE-2024-30202 is a code execution vulnerability caused by evaluating arbitrary Lisp code in Emacs when Org mode is enabled.

Who is impacted by CVE-2024-30202?

Users of GNU Emacs and Org Mode prior to the specified versions are at risk due to CVE-2024-30202.

CVE-2024-30202: Code Injection

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2024-30202?

How do I fix CVE-2024-30202?

What versions are affected by CVE-2024-30202?

What type of vulnerability is CVE-2024-30202?

Who is impacted by CVE-2024-30202?

Company

Resources

Contact