Description

A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-23T11:17:18.550Z",
  "pubdate": "2026-09-23T11:17:18.550Z",
  "executiveSummary": "A critical security vulnerability exists within the Flymake mode of Emacs versions prior to 31.2, resulting in arbitrary code execution.\nThe vulnerability originates from the insecure handling of language backends, which can execute malicious instructions embedded within processed files during syntax checking.\nThis flaw allows a remote or local attacker to gain full control over the Emacs process with the privileges of the user running the application.\nExploitation does not require prior authentication, as the trigger is the standard file-opening or editing workflow in Emacs.\nThe risk is significant, as merely opening an untrusted file can initiate the malicious payload, potentially leading to unauthorized data exfiltration, system compromise, or lateral movement within the user's environment.\nUsers are at high risk when interacting with files obtained from unverified sources, as the Flymake backend may interpret arbitrary content as executable code instructions.",
  "technicalDetails": "The vulnerability resides in the Flymake integration layer of Emacs, specifically in how the editor interfaces with third-party language backends. Flymake is an on-the-fly syntax checking framework that automatically runs external tools or scripts to validate code as the user types or views a file.\nThe root cause is an implicit trust model wherein the Flymake infrastructure fails to sanitize or restrict the data passed to or received from backend processes. When Emacs invokes a language backend to perform syntax checking, it fails to sufficiently isolate the execution environment or validate the commands generated based on the content of the file being processed.\nThe attack flow proceeds as follows: An attacker creates a maliciously crafted file containing specific syntax constructs or metadata designed to be parsed by a targeted Flymake language backend. When a user opens this file in an affected version of Emacs, the Flymake mode automatically initializes the relevant backend to perform syntax analysis. The backend, misinterpreting the malicious input as valid commands or directives, triggers a system-level execution flow. Because the backend operates within the context of the user's Emacs session, the arbitrary code injected by the attacker is executed with the effective privileges of the user account currently logged into the system.\nThe exploitation method relies on the automated nature of Flymake. By leveraging language-specific backends—other than Lisp—the vulnerability bypasses standard security expectations regarding text editors. The payload behavior is contingent upon the backend's specific command-line arguments and input processing logic, which can lead to command injection or the execution of arbitrary scripts defined within the untrusted document.\nAffected versions include all releases of Emacs prior to 31.2. There is no requirement for network connectivity or local authentication for exploitation; the vulnerability is triggered locally through the file interaction process itself, making it highly impactful in environments where users frequently handle files from external or untrusted sources."
}