Important: emacs

Issue Overview: GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992. CVE-2026-108976 Affected Packages: emacs Note:...

emacs security update

1:29.4-17 - Fix arbitrary code execution upon opening file CVE-2026-96269 1:29.4-16 - Generalize trusted-content-p check to all Flymake backends CVE-2026-96442 1:29.4-15 - tramp: restrict user name to prevent shell injection CVE-2026-79992...

SUSE SLED15 / SLES15 Security Update : emacs (SUSE-SU-2026:4893-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4893-1 advisory. - CVE-2026-79992: zero-click local command execution via TRAMP bsc1275927. - CVE-2026-108976: flawed username...

Security update for emacs

This update for emacs fixes the following issues: CVE-2026-79992: zero-click local command execution via TRAMP bsc1275927. CVE-2026-108976: flawed username input regex validation in TRAMP can cause arbitrary OS command injection bsc1284345, bsc1284990. Patch Instructions: To install this SUSE...

SUSE-SU-2026:4893-1 Security update for emacs

This update for emacs fixes the following issues: - CVE-2026-79992: zero-click local command execution via TRAMP bsc1275927. - CVE-2026-108976: flawed username input regex validation in TRAMP can cause arbitrary OS command injection bsc1284345, bsc1284990...

AlmaLinux 9.6 [TuxCare] Security Update: emacs / emacs-common / emacs-devel / emacs-filesystem / emacs-lucid / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792623317)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792623317 advisory. - GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp- user-regexp has an...

Rocky Linux 9.6 [TuxCare] Security Update: emacs / emacs-common / emacs-devel / emacs-filesystem / emacs-lucid / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792623317)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792623317 advisory. - GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp- user-regexp has an...

CLSA-2026-1792623317 emacs: Fix of CVE-2026-79992

CVE-2026-79992: restrict Tramp user and host names...

CLSA-2026-1792478956 emacs: Fix of 2 CVEs

CVE-2026-108976: fix Tramp user and host name validation - CVE-2026-79992: strengthen Tramp user and host name limitations...

CLSA-2026-1792478726 emacs: Fix of 2 CVEs

CVE-2026-108976: fix Tramp user and host name validation - CVE-2026-79992: strengthen Tramp user and host name limitations...

RockyLinux 9 : emacs (RLSA-2026:80507)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:80507 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: local shell command injection through the use...

FreeBSD : Emacs -- Local command injection via crafted file names in TRAMP (436ad1a7-ccc8-11f1-af18-c4ff99d93a55)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 436ad1a7-ccc8-11f1-af18-c4ff99d93a55 advisory. TRAMP Transparent Remote file Access, Multiple Protocol is a part of Emacs that provides an...

RockyLinux 8 : emacs (RLSA-2026:80506)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:80506 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: local shell command injection through the use...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: emacs (UTSA-2026-142367)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142367 advisory. A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenate...

AlmaLinux 10 : emacs (ALSA-2026:84591)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:84591 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: emacs: Command injection via crafted filename...

AlmaLinux 9 : emacs (ALSA-2026:80507)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:80507 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: local shell command injection through the user...

RHEL 8 : emacs (RHSA-2026:80506)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:80506 advisory. GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp,...

AlmaLinux 8 : emacs (ALSA-2026:80506)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:80506 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: local shell command injection through the user...

Oracle Linux 9 : emacs (ELSA-2026-80507)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-80507 advisory. 1:27.2-18.el98.2 - Fix integer overflow in pbmload image validation RHEL-248067 1:27.2-18.el98.1 - Restrict Tramp user name to fix CVE-2026-79992...

emacs: emacs: Command injection via crafted filenames in TRAMP

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitra...