CVE-2025-1244: Emacs: shell injection vulnerability in gnu emacs via custom "man" uri scheme
A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect.
Other sources
A shell injection vulnerability exists in GNU Emacs due to improper handling of custom "man" URI schemes. Initially considered low severity, as it required user interaction with local files, it was later discovered that an attacker could exploit this vulnerability by tricking a user into visiting a specially crafted website or an HTTP URL with a redirect, leading to arbitrary shell command execution without further user action.This issue affects all released versions of GNU Emacs, including version 29.4.
Upstream patch: https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=820f0793f0b46448928905552726c1f1b999062f
— Red Hat
Emacs: shell injection vulnerability in gnu emacs via custom "man" uri scheme
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 29.4-2 - Upgrade
Upgrade
GNU Emacsto a version that resolves this vulnerability.Fixed in 29.4Patch 820f0793f0b46448928905552726c1f1b999062f - Compensating control
Prevent users from following untrusted custom "man" URI schemes or redirect-based URLs to mitigate the GNU Emacs shell injection (arbitrary shell command execution) until the upstream patch is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1244?
CVE-2025-1244 is classified as a high severity vulnerability due to the potential for arbitrary command execution by attackers.
How do I fix CVE-2025-1244?
To mitigate CVE-2025-1244, users should update to the latest version of GNU Emacs that addresses this vulnerability.
Who is affected by CVE-2025-1244?
CVE-2025-1244 affects all users of GNU Emacs that do not have the security patch applied.
What are the attack vectors for CVE-2025-1244?
Attackers can exploit CVE-2025-1244 by tricking users into visiting malicious websites that utilize custom "man" URI schemes.
What kind of impact can CVE-2025-1244 have on my system?
CVE-2025-1244 can lead to unauthorized execution of shell commands, compromising system integrity and security.