This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Emacs fixes 2 high-severity vulnerabilities
Emacs fixes 2 high-severity vulnerabilities with version 30.1 [1][2]. Among operating systems, a fix has been released, for example, by Slackware as SSA:2025-057-01 [3] and by Debian in version 1:27.1+1-3.1+deb11u6 for the bullseye (security) release, 1:28.2+1-15+deb12u4 for bookworm (security) and 1:30.1+1-3 for sid and trixie [4][5]. Red Hat provided a fix for CVE-2025-1244 [6][7]. Gentoo offers version 30.1 as a testing version [8].
Using social engineering, an unauthenticated remote attacker can execute arbitrary shell commands due to insufficient input validation and processing of the "man" URI [6][9].
The vulnerability is present in product:
- *:Emacs;<30.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-1244 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 12. 2. 2025.
An unauthenticated remote attacker can execute code through a malicious .el file due to faulty macro expansion in Emacs Lisp when viewing or editing code on the victim's machine. The code may be executed automatically during error checking (Flymake/Flycheck) or code completion [7][10]. Risk mitigation consists of disabling automatic error checking using Flymake/Flycheck, disabling automatic code completion in untrusted .el files, and setting "enable-local-eval" to "nil". The fixed version implements these mechanisms. Detailed information about the vulnerability is available at [10].
The vulnerability is present in product:
- *:Emacs;<30;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-53920 at cve.org, NVD
- CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 27. 11. 2024.
Links
- [1] https://lists.gnu.org/archive/html/info-gnu/2025-02/msg00009.html
- [2] https://www.openwall.com/lists/oss-security/2025/02/26/2
- [3] http://www.slackware.com/security/viewer.php?l=slackware-security&y=2025&m=slackware-security.396090
- [4] https://security-tracker.debian.org/tracker/CVE-2025-1244
- [5] https://security-tracker.debian.org/tracker/CVE-2024-53920
- [6] https://access.redhat.com/security/cve/cve-2025-1244
- [7] https://access.redhat.com/security/cve/cve-2024-53920
- [8] https://packages.gentoo.org/packages/app-editors/emacs
- [9] https://github.com/advisories/GHSA-gghq-qp34-gqg8
- [10] https://eshelyaron.com/posts/2024-11-27-emacs-aritrary-code-execution-and-how-to-avoid-it.html
By CESNET, z.s.p.o. Michaela Ručková on 5. 3. 2025.