TECH Signal 407
Arbitrary code execution vulnerability in Emacs affects versions 28.1 onward; mitigation lands on emacs-31 branch only
↗
Illustration only Photo by Declan Sun on Unsplash
A specially-crafted file can trigger attacker-controlled Emacs Lisp execution on file open in all Emacs versions from 28.1 onward, exploiting symbol shorthands, with no released version currently patched.
The exploit works in the default configuration, affects any file regardless of extension, and executes before file contents are displayed. No released Emacs version includes the fix, and there are no plans for security backports, so engineers packaging or running Emacs must cherry-pick the mitigation commit or apply a configuration workaround themselves.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The vulnerability abuses Emacs Lisp symbol shorthands, a feature added in Emacs 28.1, to execute arbitrary code when a file is opened, before its contents are displayed.
Commit 8466eb44 on the emacs-31 release branch mitigates the issue by binding read-symbol-shorthands to nil around risky intern calls, but no released Emacs version currently carries this fix.
A more fundamental fix on the master branch removes the connection between symbol shorthands and interning symbols, but it will only appear in Emacs 32.
THE CLUSTER