In Emacs before 29.4 org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function such as shell-command-to-string. This affects Org Mode before 9.7.5.

🗓️ 05 Aug 2024 07:00:00Reported by MicrosoftType

Before Emacs 29.4, org-link-expand-abbrev expands unsafe %(...) links such as shell-command-to-string in Org Mode prior to 9.7.5.

Reporter	Title	Published	Views	Family All 154
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	15 Apr 202502:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Business Automation Manager Open Editions 8.0.6	15 Apr 202502:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an arbitrary code execution in GNU Emacs [CVE-2024-39331]	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a security weakness in GNU Emacs [CVE-2024-39331]	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Packet Capture includes components with multiple known vulnerabilities	30 Jan 202513:31	–	ibm
Tenable Nessus	Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2024-663)	22 Jul 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2 : emacs (ALAS-2024-2608)	17 Aug 202400:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0206: emacs (ALINUX3-SA-2024:0206)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 9 : emacs (ALSA-2024:6510)	11 Sep 202400:00	–	nessus