Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-108976: GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | emacs | 1:27.2-4.amzn2.0.10 |
| Amazon Linux · 2 | emacs-common | 1:27.2-4.amzn2.0.10 |
| Amazon Linux · 2 | emacs-debuginfo | 1:27.2-4.amzn2.0.10 |
| Amazon Linux · 2 | emacs-devel | 1:27.2-4.amzn2.0.10 |
| Amazon Linux · 2 | emacs-filesystem | 1:27.2-4.amzn2.0.10 |
| Amazon Linux · 2 | emacs-lucid | 1:27.2-4.amzn2.0.10 |
| Amazon Linux · 2 | emacs-nox | 1:27.2-4.amzn2.0.10 |
| Amazon Linux · 2 | emacs-terminal | 1:27.2-4.amzn2.0.10 |
Vulnerabilities 1
-
High 7.8
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp ha…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-108976.html