REDHAT-BUG-2523665: Command Injection

Published Aug 25, 2026

Updated

Emacs TRAMP is vulnerable to a local shell command injection when processing maliciously crafted filenames. The vulnerability arises from the fact of TRAMP concatenating login arguments without a proper sanitization and further passing the result into a local shell.

Affected Software

1 affected component

Emacs TRAMP

Event History

Aug 25, 2026

Data Sourced

via Red Hat·04:52 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The issue is described as a local shell command injection through maliciously crafted filenames. An attacker would need a way to cause TRAMP to process such a filename on the affected system.

What component should be prioritized for remediation?

Prioritize systems using the Emacs TRAMP component, particularly where users may open or process filenames obtained from untrusted local sources.

REDHAT-BUG-2523665: Command Injection

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What component should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What component should be prioritized for remediation?