Loading vulnerability…
Local shell command injection in GNU Emacs TRAMP
CVE-2026-79992 is a local command-injection vulnerability in GNU Emacs TRAMP. TRAMP constructs remote-login commands by concatenating expanded login arguments without adequate sanitization or shell quoting, allowing shell metacharacters in the username portion of a crafted remote-file specification to reach a local shell. Processing a malicious filename, including a crafted symbolic-link target or a filename checked through file-exists-p, can execute injected commands with the privileges of the user running Emacs. A filename-dispatch expression anchored to the beginning of a line rather than the beginning of the string also allows remote-file syntax following a newline to trigger TRAMP processing. Exploitation does not require a successful remote connection.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary local command execution in the security context of the affected Emacs process, potentially compromising the confidentiality, integrity, and availability of resources accessible to that user. It does not inherently grant elevated privileges; consequences depend on the permissions of the account running Emacs. The vulnerability is rated CVSS v3.0 7.8, with local access, low privileges, low attack complexity, and no required user interaction.
If you can’t patch tonight, do this now.
Until patched, avoid allowing Emacs to process untrusted filenames, symbolic-link targets, or TRAMP connection specifications, particularly those with attacker-controlled username fields. Avoiding explicit remote-file opening alone is insufficient because filename checks can trigger the vulnerable behavior. Failure of a remote connection does not prevent local command execution.
Patch, then assume compromise.
Install the latest vendor-supported Emacs security update addressing CVE-2026-79992 and the related incomplete-fix vulnerability CVE-2026-108976. Emacs 31.1 introduced the initial username restrictions for CVE-2026-79992, but those restrictions were incomplete; upgrade to Emacs 31.2 or later, or use distribution packages containing equivalent fixes for both issues. For separately maintained TRAMP installations, obtain a vendor-confirmed fixed release rather than relying solely on the bundled Emacs version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
59 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.