TI-2026-70801 Aliases CVE-2026-108976 GHSA-f2f9-wp9v-23mf

OS command injection in GNU Emacs and TRAMP via filenames

LOW 37CWE-184Published 2026-10-11 · Updated 2026-10-15

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

GNU Emacs before 31.2 and TRAMP through 2.8.2 are affected. The tramp-user-regexp check uses an incomplete list of disallowed inputs (CWE-184), so a filename can inject OS commands. A local attacker with low privileges can exploit this without user interaction to affect confidentiality, integrity and availability. This issue is an incomplete fix for an earlier flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00647 51st percentileScored 2026-11-07

Fix Partial Emacs (GNU): 31.2Red Hat: 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
GNU	Emacs	before 31.2	31.2	Patch available	CNA

Emacs VendorGNU Affected before 31.2 Fixed in 31.2 Patch available CNA

Remediation

Upgrade GNU Emacs to version 31.2. The sources list no fixed version for TRAMP. Red Hat lists Red Hat Enterprise Linux 6 with no fix planned and Red Hat Enterprise Linux 7, 8, 9 and 10 with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA Emacs (GNU) Fixed in 31.2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix yet
Red Hat Enterprise Linux 8	Affected	No fix yet
Red Hat Enterprise Linux 9	Affected	No fix yet

Timeline

2026-10-11 Threatist record created from CVE-2026-108976
2026-10-11 Alias added: GHSA-f2f9-wp9v-23mf
2026-10-12 Priority changed: MEDIUM → LOW
2026-10-15 Affected versions changed · Red Hat
2026-10-15 CVSS score added · Red Hat
2026-10-16 CISA SSVC decision points changed
2026-10-25 EPSS moved to the 50th–90th percentile

References

Patch 1

https://www.openwall.com/lists/oss-security/2026/10/11/1

Other 2

TI-2026-19388 telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root"… KEVCVSS 3.1CRITICAL 9.8
TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
TI-2014-05164 GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the… KEVCVSS 3.1HIGH 8.8
TI-2023-04522 Glibc: buffer overflow in ld.so leading to privilege escalation KEVCVSS 3.1HIGH 7.8
TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8

See all 1272 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences