CVE-2026-108976: Command Injection
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU Emacsto a version that resolves this vulnerability.Fixed in 31.2
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability has a local attack vector and requires low privileges. No user interaction is required according to the supplied severity vector.
Which versions are affected?
GNU Emacs versions before 31.2 are affected. TRAMP through version 2.8.2 is also affected.
What is the underlying cause?
Command injection is possible through a filename because tramp-user-regexp does not completely block disallowed inputs. The issue is described as an incomplete fix for CVE-2026-79992.