Loading story…
A critical flaw in GNU Emacs TRAMP can lead to local command execution when Emacs processes specially crafted file names, symlink targets, or remote-style paths. The issue stems from shell command injection in the TRAMP user field, where login arguments are concatenated without proper quoting and passed to a local shell during connection setup. A second weakness in TRAMP file name dispatch uses line anchoring instead of full-string anchoring, allowing embedded "/ssh:..." substrings inside otherwise ordinary paths to reach the vulnerable code path before any real SSH connection is established.
The bug was disclosed on the oss-sec mailing list by Sean Whitton, crediting Bas Alberts of GitHub Security Lab for discovery and Michael Albinus for the fix. Discussion on the thread indicated the upstream fix is expected in Emacs 31, while Gentoo has already backported patches for multiple releases, including 27.2, 28.2, 29.4, 30.2, and 31.1_rc1. Gentoo also issued GLSA-202608-21, and Tenable published Nessus plugin 339063 to identify affected Emacs installations on Gentoo through version checks, with upgrades recommended for supported 27, 28, 29, and 30 branches.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Sean Whitton announced that the GNU Emacs TRAMP zero-click local command-execution vulnerability was assigned CVE-2026-79992. The notice identifies Emacs 30.2 and later as affected, while noting earlier versions may also be vulnerable.
Tenable published Nessus plugin 339063 to detect Gentoo systems affected by GLSA-202608-21. The plugin is rated High severity and checks self-reported package versions instead of attempting exploitation.
Gentoo published GLSA-202608-21 covering an arbitrary code execution vulnerability in GNU Emacs and recommended fixed package versions for branches 27 through 30. Tenable's Nessus plugin entry reflects the advisory and notes detection is version-based rather than exploit-based.
Sam James reported that Gentoo had already backported downstream patches for Emacs 27.2, 28.2, 29.4, 30.2, and 31.1_rc1 for the TRAMP issue. He also said he believed the vulnerability would be fixed in Emacs 31.
A follow-up reply in the oss-sec thread stated that Emacs does not have separate security releases and asked whether the TRAMP issue would be fixed in Emacs 31. The message reflected ongoing public discussion of remediation plans rather than a confirmed upstream fix.
Sean Whitton disclosed a critical GNU Emacs TRAMP local command execution vulnerability on the oss-sec mailing list, crediting Bas Alberts of GitHub Security Lab for discovering it. The disclosure described command injection via the TRAMP user field and a file name dispatch flaw that could trigger execution from crafted paths or symlink targets.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourcetenable.com
Open sourceseclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly disclosed GNU Emacs vulnerability allows **arbitrary code execution** when a user opens a malicious file, affecting Emacs **28.1 and later**. The issue was reported by researcher **Eshel Yaron** and discussed on both `oss-sec` and `emacs-devel`, where maintainers treated it as serious enough to factor into Emacs 31 release decisions. The flaw is tied to unsafe handling of `read-symbol-shorthands` around risky `intern` calls, with discussion highlighting the VC-related attack path as one of the easiest ways to trigger the bug. Upstream published a workaround patch for the **Emacs 31** branch and committed a broader rework on `master`, while **Gentoo** backported fixes that nullify `read-symbol-shorthands` around vulnerable code paths and shipped updated packages for **28.2**, **29.4**, and **30.2**. Gentoo later issued **GLSA-202608-18**, and Tenable released a Nessus detection plugin for affected Gentoo installations. As an interim mitigation, users were advised to disable **file-local variables** if they cannot immediately apply patched versions.
Aug 20, 2026
Electerm patched a high-severity path traversal flaw, tracked as **CVE-2026-73223**, that could let a malicious SFTP server write attacker-controlled content outside the application's temporary directory. The bug affected versions prior to **3.15.120** and was caused by unsanitized server-controlled filenames being passed into `path.resolve` inside the `editWithSystemEditor` workflow in `src/client/components/sftp/file-item.jsx`. The issue is classified as **CWE-22** and carries a **CVSS 3.1** score vector of `AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H`, indicating high impact to integrity and availability with user interaction required. A related GitHub commit shows Electerm added filename sanitization in its FTP/SFTP transfer logic, importing a `sanitizeFilename` helper and applying it to file and folder names before resolving destination paths. That remediation hardens transfer and folder-creation operations against unsafe path handling and aligns with the vendor's fix in version **3.15.120**. Organizations using Electerm for remote access or file transfer should upgrade to the patched release and treat untrusted SFTP servers as a potential delivery vector for arbitrary file writes.
Aug 12, 2026
Electerm fixed a high-severity command injection vulnerability tracked as **`CVE-2026-73224`** that could let a malicious FTP or SFTP server execute arbitrary commands on a user's system. The flaw affected versions prior to **`3.15.120`** and was triggered when a user downloaded a crafted folder and then opened **Properties** and used **Calculate Size**. According to the advisory, the application passed a server-controlled folder name into a shell command used to run `du -sh` without properly escaping single quotes, creating a **CWE-78** command injection condition. The issue was addressed in Electerm **`v3.15.120`**, whose release notes describe multiple security fixes for unsafe file-name parsing across custom editor actions, FTP/SFTP transfers, folder size checks, and RDP file transfer workflows. The vulnerability carries a **CVSS 3.1** rating of **`AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`**, indicating high impact to confidentiality, integrity, and availability, and users are advised to upgrade to the patched release.
Aug 12, 2026