Summary
It was discovered that Emacs could trigger unsafe Lisp macro expansion,
when a user invoked elisp-completion-at-point on untrusted Emacs Lisp
source code. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2024-53920)
It was discovered that Emacs did not properly sanitize input when
handling certain URI schemes. An attacker could possibly use this issue
to execute arbitrary shell commands by tricking a user into opening a
specially crafted URL. (CVE-2025-1244)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | emacs | 1:26.3+1-1ubuntu2+esm2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | emacs | 1:27.1+1-3ubuntu5.2+esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | emacs | 1:29.3+1-1ubuntu2+esm3 |
Vulnerabilities 2
-
High 8.8
Emacs: shell injection vulnerability in gnu emacs via custom "man" uri scheme
A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or …
-
High 7.8
In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion)…