Loading vulnerability…
Arbitrary code execution through unsafe Lisp macro expansion in GNU Emacs
GNU Emacs before version 30.1 performs unsafe Lisp macro expansion when elisp-completion-at-point is invoked on untrusted Emacs Lisp source code. Macro expansion can execute unrestricted Emacs Lisp supplied by an attacker rather than merely analyze the source for completion. The same unsafe expansion can occur during on-the-fly diagnostics that byte-compile untrusted Emacs Lisp. Successful exploitation executes arbitrary code with the privileges of the user running Emacs.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attacker-controlled Lisp can compromise the confidentiality, integrity, and availability of resources accessible to the Emacs process. Potential consequences include reading sensitive data, modifying or deleting files, executing system commands, and disrupting the user's applications. The vulnerability does not inherently grant privileges beyond those of the Emacs process.
If you can’t patch tonight, do this now.
Avoid viewing or editing untrusted Emacs Lisp source. If this is unavoidable, do not invoke elisp-completion-at-point, disable automatic completion and Flymake or Flycheck checking for that content, and avoid byte compilation. Set enable-local-eval to nil as an additional precaution. Where trusted-content controls are available, trust only explicitly vetted content and do not configure blanket trust using :all.
Patch, then assume compromise.
Upgrade to GNU Emacs 30.1 or a distribution package containing the backported fix for CVE-2024-53920. Emacs 30 introduced trusted-content controls and disabled the elisp-flymake-byte-compile backend for untrusted files. The original remediation was subsequently found incomplete for Flymake backends in other editing modes; that separate issue is tracked as CVE-2026-96442. Apply vendor updates addressing that issue as well rather than treating version 30.1 as complete protection against all related execution paths.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.