Emacsの脆弱性CVEが未採番だから報告したら、 Tomas Hoger commented: Hi OS開発者 We have confirmed this issue affecting emacs packages in Red Hat Enterprise Linux and started fixing process. There is not CVE assigned to this issue yet, hence we can not point you to the CVE page. Are you interested in any specific version? – Red Hat Product Security Red hatが動いた。 Message-ID: <20260921214300.4e0314a7@moche20> Date: Mon, 21 Sep 2026 21:43:00 +0200 From: Tomas Hoger <[email protected]> To: Sean Whitton <[email protected]>, Bas Alberts <[email protected]> Cc: [email protected], Eli Zaretskii <[email protected]>, Michael Albinus <[email protected]>, Stefan Monnier <[email protected]>, João Távora <[email protected]> Subject: Re: Emacs arbitrary code execution: incomplete fix for CVE-2024-53920 On Mon, 14 Sep 2026 11:47:17 +0100 Sean Whitton wrote: > Bas Alberts of the GitHub Security Lab discovered that the fix for > CVE-2024-53920, an arbitrary code execution flaw in Emacs, was > incomplete. Viewing or editing untrusted text files in modes other than > Emacs Lisp mode can also permit arbitrary code execution. For example: > > #!/usr/bin/perl > # -*- mode: perl; mode: flymake -*- > BEGIN { system("touch uh_oh.txt"); } > > This problem affects all Emacs versions affected by CVE-2024-53920. > This means Emacs 24 and newer, and possibly also older versions. > > A minimal fix, attached, is queued up for release with Emacs 31.2. > We (the Emacs upstream maintainers) don't expect to backport the fix to > older Emacs releases ourselves. > > This fix is more aggressive than the one we have on our master branch in > that it also implicitly disables the Eglot flymake backend. > I think we will be able to undo that before releasing Emacs 31.2, but I > wanted to get this notification out as soon as possible. > > I would be grateful if someone could assign us a CVE for this issue. Is GitHub going to assign a CVE here? I think GitHub assignment would be ok per this part of the GitHub CNA scope definition: "vulnerabilities affecting open source projects discovered by security researchers at GitHub or Microsoft not covered by another CNA’s scope." If GitHub is not doing assignment, Red Hat can provide it instead. -- Tomas Hoger / Red Hat Product Security
Post summary
The text discloses that the fix for CVE-2024-53920 in Emacs was incomplete, allowing arbitrary code execution via untrusted text files in non-Lisp modes; a minimal fix is queued for Emacs 31.2 and Red Hat has confirmed and begun addressing the issue.
