Description
An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | emacs | 1:28.2+1-11 | — |
| Debian 13 | emacs | 1:28.2+1-11 | — |
| Debian 12 | emacs | 1:28.2+1-11 | — |
| Debian 11 | emacs | 1:27.1+1-3.1+deb11u2 | DSA-5360-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | xemacs21 +1 | No fix yet | — |
| Ubuntu 26.04 LTS | xemacs21 +1 | No fix yet | — |
| Ubuntu 25.10 | xemacs21 +1 | No fix yet | — |
| Ubuntu 24.04 LTS | xemacs21 +1 | No fix yet | — |
| Ubuntu 22.04 LTS | emacs | 1:27.1+1-3ubuntu5.2 | USN-7027-1 |
| Ubuntu 22.04 LTS | xemacs21 +1 | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | xemacs21 +1 | No fix yet | — |
| Ubuntu 18.04 LTS | xemacs21 +1 | No fix yet | — |
| Ubuntu 16.04 LTS | xemacs21 +1 | No fix yet | — |
| Ubuntu Pro 24.04 LTS | emacs | 1:29.3+1-1ubuntu2+esm1 | USN-7027-1 |
| Ubuntu Pro 20.04 LTS | emacs | 1:26.3+1-1ubuntu2+esm1 | USN-7027-1 |
| Ubuntu Pro 18.04 LTS | emacs25 | 25.2+1-6ubuntu0.1~esm2 | USN-7027-1 |
| Ubuntu Pro 16.04 LTS | emacs24 | 24.5+1-6ubuntu1.1+esm4 | USN-7027-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | emacs +4 | 1:27.2-8.el9_2.1 | RHSA-2023:2626 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | emacs +4 | 1:27.2-8.el9_2.1 | ALSA-2023:2626 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | emacs | 27.2-150400.3.6.1 | SUSE-SU-2023:0598-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | emacs | 28.2-2.1 | openSUSE-SU-2024:12721-1 |
| openSUSE Leap 15.4 | emacs | 27.2-150400.3.6.1 | SUSE-SU-2023:0598-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | emacs +6 | 1:28.2-3.amzn2023.0.3 | ALAS2023-2023-122 |
| Amazon Linux 2 | emacs +6 | 1:27.2-4.amzn2.0.3 | ALAS2-2023-1981 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | emacs | 28.2-4 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | emacs +4 | 1:27.2-8.el9_2.1 | ELSA-2023-2626 |
Advisories 12
- ALSA-2023:2626 Important: emacs security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2023-2917 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 30, 2026
- USN-7027-1 emacs, emacs24, emacs25 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DSA-5360-1 emacs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:12721-1 emacs-28.2-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:0598-1 Security update for emacs SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2023:2626 Red Hat Security Advisory: emacs security update Red Hat Security Advisories (RHSA) · Jan 22, 2026
- WID-SEC-2023-1542 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- ALAS2023-2023-122 Important: emacs security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 9, 2025
- WID-SEC-2023-0437 GNU Emacs: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Sep 19, 2024
- ELSA-2023-2626 Important: emacs security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 17, 2023
- ALAS2-2023-1981 Important: emacs security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 7, 2023
References
- https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=9a3b08061feea14d6f37685ca1ab8801758bfd1c
- DSA-5360 vendor-advisory
- FEDORA-2023-5763445abe vendor-advisory
- FEDORA-2023-29df561f1d vendor-advisory