Description

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-25T18:18:06.973Z",
  "pubdate": "2026-08-25T18:18:06.973Z",
  "executiveSummary": "A critical command injection vulnerability exists within the Emacs TRAMP (Transparent Remote Access, Multiple Protocol) package. The flaw originates from insufficient sanitization of filename arguments before they are processed by the underlying local shell environment.\nA local attacker can leverage this vulnerability by crafting malicious filenames that, when handled by TRAMP, trigger unintended shell execution. Because TRAMP frequently invokes remote access commands—such as SSH or SCP—by concatenating strings to construct shell command lines, the lack of proper input validation allows for the injection of arbitrary shell metacharacters.\nSuccessful exploitation results in arbitrary code execution with the privileges of the Emacs process. This poses a significant security risk, as it allows attackers to bypass intended security controls, access sensitive local files, or execute unauthorized commands. The vulnerability does not require remote network access, as the vector is triggered locally via filename processing. Users of affected versions of Emacs are at risk if they interact with untrusted directory structures or receive files with maliciously crafted names, as the mere act of listing or accessing these files through TRAMP can initiate the exploit sequence.",
  "technicalDetails": "The vulnerability resides in the TRAMP component of Emacs, specifically in the logic responsible for building command strings used to establish remote connections. TRAMP functions as an abstraction layer for editing files on remote machines, internally invoking standard command-line tools like ssh, scp, or rsync to facilitate data transfer and shell sessions.\nThe root cause is an improper neutralization of special characters during the concatenation of user-provided filenames into shell command strings. When TRAMP constructs these command lines, it fails to properly escape or quote filename arguments. If a filename contains shell-active metacharacters—such as semicolons (;), backticks (`), pipes (|), or subshell syntax ($())—the local shell interpreting the command string may parse these characters as command separators or execution directives rather than literal parts of the file path.\nThe exploitation flow begins when an attacker places a file with a crafted, malicious name in a directory that is subsequently accessed or listed by a victim using TRAMP-enabled Emacs. When the user navigates to this directory, TRAMP triggers a refresh or file identification routine that passes the malicious filename through its internal command-construction logic. The resulting shell command string incorporates the attacker-supplied payload without adequate sanitization. Upon invocation of the local shell process, the injected commands are executed with the full user-level privileges of the Emacs process owner.\nBecause the payload is executed by the shell process that handles the TRAMP connection, the attacker gains the ability to execute arbitrary commands, potentially leading to privilege escalation, persistent access, or exfiltration of sensitive information from the user's home directory. The vulnerability is triggered locally and does not require active authentication, provided the attacker can influence the environment where the victim opens files or directory listings. The impact is significant because Emacs is often used in automated scripts or workflows where directory content might be automatically parsed. Any TRAMP version that performs direct string concatenation of filenames before execution is susceptible to this shell injection vector. The exposure is confined to the local system where Emacs is running, but the consequences of arbitrary code execution within the user context remain severe, potentially compromising the integrity and confidentiality of the local user session."
}