CVE-2026-79992: Emacs: local shell command injection through the user field in emacs tramp
A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.
Other sources
Emacs TRAMP is vulnerable to a local shell command injection when processing maliciously crafted filenames. The vulnerability arises from the fact of TRAMP concatenating login arguments without a proper sanitization and further passing the result into a local shell.
— Red Hat
Emacs: local shell command injection through the user field in emacs tramp
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 29.4-5
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Emacs TRAMP are exposed when they process maliciously crafted filenames. Exploitation is local and requires an attacker to have local access with low privileges.
What does an attacker need to do to exploit it?
The attacker needs to cause TRAMP to process a maliciously crafted filename containing login arguments that are concatenated and passed to a local shell without proper sanitization. No user interaction is required according to the provided vector.
What is the potential impact of successful exploitation?
Successful exploitation can result in arbitrary code execution through local shell command injection. The supplied severity vector indicates high impacts to confidentiality, integrity, and availability.