Description

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-10-11T21:16:43.580Z",
  "pubdate": "2026-10-11T21:16:43.580Z",
  "executiveSummary": "This vulnerability is an OS command injection flaw affecting GNU Emacs versions prior to 31.2 and TRAMP through 2.8.2. The issue originates from an incomplete remediation of CVE-2026-79992, specifically concerning an insufficient validation mechanism within the tramp-user-regexp configuration.\nThe vulnerability allows a remote or local attacker to execute arbitrary system commands by crafting malicious filenames that bypass existing input sanitization filters. By exploiting the way TRAMP parses user-related regular expressions in file paths, an attacker can escape the intended path context to inject shell metacharacters or commands that are subsequently executed with the privileges of the Emacs process.\nThis poses a critical risk to system integrity and confidentiality, as successful exploitation results in unauthorized code execution. Given the nature of TRAMP (Transparent Remote Access, Multiple Protocol), this vulnerability could be triggered during file access operations, including the visiting of remote files or directory listings. Attackers require the ability to influence the filename processed by the vulnerable TRAMP functionality, which is commonly possible through shared projects, malicious git repositories, or social engineering targeting specific file path structures.",
  "technicalDetails": "The vulnerability resides in the TRAMP library's filename parsing logic, specifically within the handling of user-defined regular expressions defined by tramp-user-regexp. TRAMP is designed to facilitate transparent access to remote files via various protocols; however, its implementation relies on regex-based matching to identify user identities and hostnames within URI-style filenames.\nThe root cause is an inadequate blocklist strategy within the regex engine that fails to account for specific shell-sensitive characters or sequences that can be used to terminate the intended path string and initiate an unintended command execution shell. Because the patch provided for CVE-2026-79992 was incomplete, the underlying logic remains susceptible to input vectors that are not adequately neutralized before the string is passed to the underlying operating system shell or subprocess execution functions.\nThe attack flow initiates when the victim performs an operation on a specially crafted filename, such as opening a file through Dired, project-find-file, or automated mode-loading processes. An attacker provides a filename containing a malicious payload designed to match the 'user' segment of the TRAMP string. When the regex evaluates this filename, the parser erroneously treats the injected command sequences as legitimate user parameters.\nOnce the regex engine processes the crafted input, the TRAMP backend transitions to the command execution phase. The vulnerable function transmits the malicious string to the system shell. Because the input was not effectively sanitized or escaped, the shell interprets the injected characters—such as backticks, command substitution sequences ($()), or semicolon delimiters—as direct commands rather than part of a file path.\nThe execution context is bound to the user running the GNU Emacs session. Consequently, the injected payload inherits the environmental privileges of the Emacs instance. If Emacs is running with elevated permissions, the impact is significantly heightened, potentially leading to a full system compromise. The vulnerability does not inherently require prior authentication to the target system; however, it necessitates a mechanism by which the malicious filename is passed to the target's Emacs instance. The persistence of this flaw highlights a failure in the regex filtering logic to properly encapsulate input, allowing for a breakout from the data-processing layer into the command-execution layer of the host OS."
}