CVE-2024-39331

2024-06-2413:53:33

redhat.com

access.redhat.com

emacs

org-mode

org-link-expand-abbrev

vulnerability

unsafe function

shell-command-to-string

org mode 9.7.5

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.4%

JSON

A flaw was found in Emacs and org-mode. In affected versions of Emacs, org-link-expand-abbrev in lisp/ol.el expands a %(…) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This issue affects Org Mode before 9.7.5.