In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev…
Priority MEDIUM 51CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 13 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-94.
Summary
In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01312 70th percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 13 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
Red Hat 4 advisories
- RHSA-2024:6987 Released 2024-09-24 · Red Hat rating Moderateemacs security update
- Red Hat Enterprise Linux AppStream (v. 8) emacs-1:26.1-12.el8_10, emacs-common-1:26.1-12.el8_10, emacs-lucid-1:26.1-12.el8_10 +2
- Red Hat Enterprise Linux BaseOS (v. 8) emacs-1:26.1-12.el8_10, emacs-filesystem-1:26.1-12.el8_10
- RHSA-2024:6510 Released 2024-09-09 · Red Hat rating Moderateemacs security update
- Red Hat Enterprise Linux AppStream (v. 9) emacs-1:27.2-10.el9_4, emacs-common-1:27.2-10.el9_4, emacs-filesystem-1:27.2-10.el9_4 +2
- RHSA-2024:6203 Released 2024-09-03 · Red Hat rating Moderateemacs security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) emacs-1:26.1-10.el8_8.6, emacs-common-1:26.1-10.el8_8.6, emacs-lucid-1:26.1-10.el8_8.6 +2
- Red Hat Enterprise Linux BaseOS EUS (v.8.8) emacs-1:26.1-10.el8_8.6, emacs-filesystem-1:26.1-10.el8_8.6
Show 1 more Red Hat advisories
- RHSA-2024:4971 Released 2024-08-01 · Red Hat rating Moderateemacs security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) emacs-1:26.1-7.el8_6.5, emacs-common-1:26.1-7.el8_6.5, emacs-lucid-1:26.1-7.el8_6.5 +2
- Red Hat Enterprise Linux AppStream E4S (v.8.6) emacs-1:26.1-7.el8_6.5, emacs-common-1:26.1-7.el8_6.5, emacs-lucid-1:26.1-7.el8_6.5 +2
- Red Hat Enterprise Linux AppStream TUS (v.8.6) emacs-1:26.1-7.el8_6.5, emacs-common-1:26.1-7.el8_6.5, emacs-lucid-1:26.1-7.el8_6.5 +2
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) emacs-1:26.1-7.el8_6.5, emacs-filesystem-1:26.1-7.el8_6.5
- Red Hat Enterprise Linux BaseOS E4S (v.8.6) emacs-1:26.1-7.el8_6.5, emacs-filesystem-1:26.1-7.el8_6.5
- Red Hat Enterprise Linux BaseOS TUS (v.8.6) emacs-1:26.1-7.el8_6.5, emacs-filesystem-1:26.1-7.el8_6.5
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| RHOAI-2.13-RHEL-8 | Fixed | — |
| RHOAI-2.14-RHEL-8 | Fixed | — |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:6987 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:6510 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2024:4971 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2024:4971 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:6203 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2024:4971 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2024:6987 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.6) | Fixed | RHSA-2024:4971 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.6) | Fixed | RHSA-2024:4971 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.8) | Fixed | RHSA-2024:6203 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.6) | Fixed | RHSA-2024:4971 |
Not affected: 1 product
- Red Hat Enterprise Linux 10
Timeline
- 2026-10-02 Threatist record created from CVE-2024-39331
- 2026-10-03 Alias added: GHSA-hp3p-7892-f222
- 2026-10-30 Fix available: RHOAI-2.13-RHEL-8, RHOAI-2.14-RHEL-8 · Red Hat
- 2026-11-03 CISA SSVC decision points changed
References
Other 8
- https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29
- https://list.orgmode.org/87sex5gdqc.fsf%40localhost/
- https://lists.gnu.org/archive/html/info-gnu-emacs/2024-06/msg00000.html
- https://www.openwall.com/lists/oss-security/2024/06/23/1
- https://www.openwall.com/lists/oss-security/2024/06/23/2
- https://news.ycombinator.com/item?id=40768225
- [debian-lts-announce] 20240629 [SECURITY] [DLA 3848-1] org-mode security update
- [debian-lts-announce] 20240629 [SECURITY] [DLA 3849-1] org-mode security update
More GNU Emacs vulnerabilities
- TI-2024-36089 In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke… CVSS 3.1HIGH 7.8
- TI-2023-12576 emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code… CVSS 3.1HIGH 7.8
- TI-2022-23951 GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in… CVSS 3.1CRITICAL 9.8
- TI-2007-05829 Stack-based buffer overflow in emacs allows user-assisted attackers to cause a denial of… CVSS 2.0HIGH 10.0
- TI-2017-10588 GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with… CVSS 3.0HIGH 8.8
- TI-2012-00034 Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs… CVSS 2.0HIGH 9.3
Sources
- CVE-2024-39331 · CVE Program
- CVE-2024-39331 · NVD
- FIRST EPSS
- GHSA-hp3p-7892-f222 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-39331 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences