CVE-2026-108976

Received Received - Intake

OS Command Injection in GNU Emacs TRAMP

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: MITRE

Description

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-11

Last Modified

2026-10-11

Generated

2026-10-12

AI Q&A

2026-10-12

EPSS Evaluated

N/A

NVD

CVE-2026-108976

EUVD

EUVD-2026-97124

Affected Vendors & Products

Vendor	Product	Version / Range
GNU	Emacs	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS command injection flaw in GNU Emacs before version 31.2 and TRAMP through 2.8.2. It occurs because the tramp-user-regexp pattern used to validate filenames does not block all malicious inputs, allowing attackers to execute arbitrary commands on the system.

Detection Guidance

This vulnerability involves OS command injection via filenames due to an incomplete fix in GNU Emacs and TRAMP. To detect it, check Emacs and TRAMP versions for updates beyond 31.2 and 2.8.2 respectively. Inspect filenames used in TRAMP operations for suspicious patterns or unexpected shell metacharacters.

Impact Analysis

If exploited, this vulnerability could allow attackers to run unauthorized commands on your system with the privileges of the user running Emacs. This could lead to data theft, system compromise, or further network infiltration depending on the attacker's goals.

Compliance Impact

This vulnerability could potentially lead to unauthorized access or execution of commands on a system, which may result in data breaches or exposure of sensitive information. Such incidents could violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy) if personal or health data is compromised.

Mitigation Strategies

Update GNU Emacs to version 31.2 or later to address the command injection flaw. Additionally, ensure TRAMP is updated to version 2.8.3 or higher to prevent exploitation via filenames.

Hi! I’m here to help you understand CVE-2026-108976. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70