{"affected":[{"product":"n/a","source":"CNA: mitre","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]},{"defaultStatus":"unknown","product":"emacs","source":"ADP: CISA-ADP","vendor":"gnu","versions":[{"lessThan":"29.4","status":"affected","version":"0","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gnu:emacs:*:*:*:*:*:*:*:*","versionEndExcluding":"29.4","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2024-39331","cwes":["CWE-94"],"description":"In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.","epss":{"date":"2026-11-03","percentile":0.70944,"score":0.01323},"exploits":[],"kev":null,"metrics":[{"score":9.8,"severity":"critical","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":9.8,"severity":"critical","source":"NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793744241977,"publishedAt":1719100800000,"references":[{"source":"CNA: mitre","tags":[],"url":"https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29"},{"source":"CNA: mitre","tags":[],"url":"https://list.orgmode.org/87sex5gdqc.fsf%40localhost/"},{"source":"CNA: mitre","tags":[],"url":"https://lists.gnu.org/archive/html/info-gnu-emacs/2024-06/msg00000.html"},{"source":"CNA: mitre","tags":[],"url":"https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8"},{"source":"CNA: mitre","tags":[],"url":"https://www.openwall.com/lists/oss-security/2024/06/23/1"},{"source":"CNA: mitre","tags":[],"url":"https://www.openwall.com/lists/oss-security/2024/06/23/2"},{"source":"CNA: mitre","tags":[],"url":"https://news.ycombinator.com/item?id=40768225"},{"source":"CNA: mitre","tags":["mailing-list"],"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00023.html"},{"source":"CNA: mitre","tags":["mailing-list"],"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00024.html"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://list.orgmode.org/87sex5gdqc.fsf%40localhost/"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://lists.gnu.org/archive/html/info-gnu-emacs/2024-06/msg00000.html"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://www.openwall.com/lists/oss-security/2024/06/23/1"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://www.openwall.com/lists/oss-security/2024/06/23/2"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://news.ycombinator.com/item?id=40768225"},{"source":"ADP: CVE","tags":["mailing-list","x_transferred"],"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00023.html"},{"source":"ADP: CVE","tags":["mailing-list","x_transferred"],"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00024.html"},{"source":"cve@mitre.org","tags":["Release Notes"],"url":"https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29"},{"source":"cve@mitre.org","tags":["Mailing List","Patch"],"url":"https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8"},{"source":"cve@mitre.org","tags":["Mailing List"],"url":"https://list.orgmode.org/87sex5gdqc.fsf%40localhost/"},{"source":"cve@mitre.org","tags":["Mailing List"],"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00023.html"},{"source":"cve@mitre.org","tags":["Mailing List"],"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00024.html"},{"source":"cve@mitre.org","tags":["Mailing List"],"url":"https://lists.gnu.org/archive/html/info-gnu-emacs/2024-06/msg00000.html"},{"source":"cve@mitre.org","tags":["Mailing List"],"url":"https://news.ycombinator.com/item?id=40768225"},{"source":"cve@mitre.org","tags":["Mailing List"],"url":"https://www.openwall.com/lists/oss-security/2024/06/23/1"},{"source":"cve@mitre.org","tags":["Mailing List"],"url":"https://www.openwall.com/lists/oss-security/2024/06/23/2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes"],"url":"https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"],"url":"https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"https://list.orgmode.org/87sex5gdqc.fsf%40localhost/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00023.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00024.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"https://lists.gnu.org/archive/html/info-gnu-emacs/2024-06/msg00000.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"https://news.ycombinator.com/item?id=40768225"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"https://www.openwall.com/lists/oss-security/2024/06/23/1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"https://www.openwall.com/lists/oss-security/2024/06/23/2"}],"remediation":[{"kind":"fix","source":"cve@mitre.org","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8"},{"kind":"fix","source":"af854a3a-2127-422b-91ae-364da2661108","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8"}],"revision":"9a927924e811e117cd93c5f582c16ba853ba9a50f723f9c70bfc750138673895","sources":[{"modifiedAt":1793742758433,"name":"CNA: mitre","retrievedAt":1793743983293,"url":"https://www.cve.org/CVERecord?id=CVE-2024-39331"},{"modifiedAt":1793744241977,"name":"NVD","retrievedAt":1793751357497,"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39331"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793744000733,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-39331"}],"ssvc":{"assessedAt":1724298911255,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"CVE-2024-39331","updatedAt":1793751357497}