Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Emacs before 30.1 can run malicious code via completion
published 1 year ago
Summary
If a user runs the code‑completion feature on Emacs Lisp files that come from an unknown source, the editor could unintentionally execute harmful commands. This can happen when the editor tries to expand macros while completing or diagnosing the code. Upgrade Emacs to version 30.1 or newer, or disable automatic completion/diagnosis on untrusted files.
What to do
- Update azure emacs to version 29.4-3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | emacs |
< 29.4-3 Fix: upgrade to 29.4-3
|
Original advisory text
CVE-2024-53920 affecting package emacs for versions less than 29.4-3
In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)
References
Timeline
Published27 Nov 2024
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-53558 · OSV
Track software like this
Free during beta