Emacs, org-mode: Command Execution Vulnerability

Background

Emacs is the extensible, customizable, self-documenting real-time display editor. org-mode is an Emacs mode for notes and project planning.

Description

%(…) link abbreviations could specify unsafe functions.

Impact

Opening a malicious org-mode file could result in arbitrary code execution.

Workaround

There is no known workaround at this time.

Resolution

All Emacs users should upgrade to the latest version according to the installed slot, one of:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-editors/emacs-26.3-r19:26"

Alternatively:

 # emerge --ask --oneshot --verbose ">=app-editors/emacs-27.2-r17:27"
 


 # emerge --ask --oneshot --verbose ">=app-editors/emacs-28.2-r13:28"
 


 # emerge --ask --oneshot --verbose ">=app-editors/emacs-29.3-r3:29"

All org-mode users should upgrade to the latest package:

 # emerge --ask --oneshot --verbose ">=app-emacs/org-mode-9.7.5"