Public vulnerability disclosure

CVE-2026-79992

Emacs: emacs: command injection via crafted filenames in tramp

publishedCWE-78

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.

Investigate in Cyber JSON Markdown

Technical severity7.8 highCVSS 3.1 · CNA: redhat

Published2026-08-25Source updated 2026-11-02

Collected2026-11-022 attributed sources

Fixes and workarounds

Workaround

Users of Emacs TRAMP should avoid processing untrusted filenames or interacting with remote systems that may contain maliciously crafted file names. This operational control reduces the risk of local shell command injection.

Source: CNA: redhat

Affected products and versions

Affected products, source version ranges and reporting authorities
Product	Versions	Authority
Red Hat Enterprise Linux 10 Red Hat `emacs` https://access.redhat.com/downloads/content/package-browser/	≥ 1:29.4-14.el10_2.3; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8 Red Hat `emacs` https://access.redhat.com/downloads/content/package-browser/	≥ 1:26.1-15.el8_10.2; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 9 Red Hat `emacs` https://access.redhat.com/downloads/content/package-browser/	≥ 1:27.2-18.el9_8.2; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 6 Red Hat `emacs` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 7 Red Hat `emacs` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: affected	CNA: redhat

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

CVSS scores, vectors and reporting authorities
Version / score	Vector	Authority
3.1 / 7.8 high	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`	CNA: redhat

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References

https://access.redhat.com/errata/RHSA-2026:80506CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:80507CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:84591CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-79992CNA: redhat · vdb-entry, x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2523665CNA: redhat · issue-tracking, x_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2026/08/26/15ADP: CVE
http://www.openwall.com/lists/oss-security/2026/10/11/1ADP: CVE
http://www.openwall.com/lists/oss-security/2026/10/14/4ADP: CVE