CVE-2026-108976

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because…

Risk score: 55/100
CVSS: 7.8 v3.1
Exploit chance (30 days): 0.5%
Published: 11 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.
Affected: See advisory
Fix: Upgrade the product to 31.2 or later.
Exploitation: No known exploitation

Why it is Yellow

CVSS 7.8 high

References

https://ftp.gnu.org/gnu/tramp/tramp-2.8.2.tar.gz
https://www.openwall.com/lists/oss-security/2026/08/21/1
https://www.openwall.com/lists/oss-security/2026/10/11/1

Original description

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

Last activity 11 Oct 2026. Patch Forecast updates every hour.