VulnSocial

CVE-2026-108976

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-184

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-15: 110-15
Referenced assets1 URL
Full discourse1 post
  • LinuxSecurity@lnxsec

    A security fix is not the same thing as closing the attack path. The GNU Emacs TRAMP command-injection issue illustrates the difference. CVE-2026-108976 follows an incomplete correction for CVE-2026-79992: filename handling still leaves room for shell command injection. A closed ticket can coexist with an open trust boundary. In practical terms, it is a good time to: • Compare the original CVE-2026-79992 advisory with the follow-up CVE-2026-108976 record. • identify deployed Emacs and TRAMP versions, including separately installed copies. • confirm the vendor package actually contains the follow-up correction. • regression-test filename handling in an isolated environment. When a vulnerability reappears after a fix, who owns the evidence that the original attack class is gone? #LinuxSecurity #VulnerabilityManagement #OpenSource #DevSecOps https://linuxsecurity.com/news/desktop-security/gnu-emacs-command-injection-incomplete-fix

    0000068
    4.6K followersView on X

Explore more

Back to dashboard