GNU Emacs TRAMP Zero-Click Flaw Enables Local Command Execution

A critical flaw in GNU Emacs TRAMP can lead to local command execution when Emacs processes specially crafted file names, symlink targets, or remote-style paths. The issue stems from shell command injection in the TRAMP user field, where login arguments are concatenated without proper quoting and passed to a local shell during connection setup. A second weakness in TRAMP file name dispatch uses line anchoring instead of full-string anchoring, allowing embedded "/ssh:..." substrings inside otherwise ordinary paths to reach the vulnerable code path before any real SSH connection is established.

The bug was disclosed on the oss-sec mailing list by Sean Whitton, crediting Bas Alberts of GitHub Security Lab for discovery and Michael Albinus for the fix. Discussion on the thread indicated the upstream fix is expected in Emacs 31, while Gentoo has already backported patches for multiple releases, including 27.2, 28.2, 29.4, 30.2, and 31.1_rc1. Gentoo also issued GLSA-202608-21, and Tenable published Nessus plugin 339063 to identify affected Emacs installations on Gentoo through version checks, with upgrades recommended for supported 27, 28, 29, and 30 branches.