CVE-2024-30202

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This...

7.8 HighFix available

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.10%Up 1.1 points since Mar 26, 2024

What each source reports

CVE List Score used 7.8

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.

Record: CVE-2024-30202
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

EUVDEUVD-2024-28134 7.8

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.

Record: EUVD-2024-28134
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8r8f-v2fj-h7cp 7.8

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This...

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.

Record: GHSA-8r8f-v2fj-h7cp
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

NVD 7.8

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.

Record: CVE-2024-30202
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

OSV 7.8

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.

Record: CVE-2024-30202
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-07

OSVDEBIAN-CVE-2024-30202 7.8

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.

Record: DEBIAN-CVE-2024-30202
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVUBUNTU-CVE-2024-30202 7.8

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.

Record: UBUNTU-CVE-2024-30202
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVAZL-37082 No score

CVE-2024-30202 affecting package emacs for versions less than 29.3-1

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.

Record: AZL-37082
Updated: 2026-11-02

OSVAZL-37105 No score

CVE-2024-30202 affecting package emacs for versions less than 29.3-1

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.

Record: AZL-37105
Updated: 2026-11-02

OSVMGASA-2024-0104 No score

Updated emacs packages fix security vulnerabilities

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23. (CVE-2024-30202) In Emacs before 29.3, Gnus treats inline MIME contents as trusted. (CVE-2024-30203) In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments. (CVE-2024-30204) In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23. (CVE-2024-30205)

Record: MGASA-2024-0104
Updated: 2026-11-02

OSVUSN-7375-1 No score

org-mode vulnerabilities

It was discovered that Org Mode did not correctly handle filenames containing shell metacharacters. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-28617)

It was discovered that Org Mode could run untrusted code left in its buffer. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-30202)

It was discovered that Org Mode did not correctly handle the contents of remote files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-30205)

It was discovered that Org Mode could be made to run arbitrary Elisp code. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-39331)

Record: USN-7375-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`emacs` Azure Linux:2	before 29.3-1	29.3-1
`emacs` Azure Linux:3	before 29.3-1	29.3-1
`emacs` Debian:12	before 1:28.2+1-15+deb12u1, plus listed versions 1:28.2+1-15	1:28.2+1-15+deb12u1
`emacs` Debian:13	before 1:29.3+1-1	1:29.3+1-1
`emacs` Debian:14	before 1:29.3+1-1	1:29.3+1-1
`org-mode` Debian:12	All versions, plus listed versions 9.5.2+dfsh-59.6.10+dfsg-19.6.21+dfsg-19.6.23+dfsg-19.6.28+dfsg-1 Show 25 moreShow less 9.6.6+dfsg-1~exp19.6.7+dfsg-19.6.8+dfsg-19.6.9+dfsg-19.7.11+dfsg-19.7.13+dfsg-19.7.15+dfsg-19.7.16+dfsg-19.7.19+dfsg-19.7.25+dfsg-19.7.27+dfsg-19.7.29+dfsg-19.7.34+dfsg-19.7.36+dfsg-19.7.5+dfsg-19.7.6+dfsg-19.7.6+dfsg-29.8.10+dfsg-19.8.12+dfsg-19.8.2+dfsg-19.8.3+dfsg-19.8.4+dfsg-19.8.6+dfsg-19.8.7+dfsg-19.8.9+dfsg-1	None known
`org-mode` Debian:13	before 9.6.23+dfsg-1	9.6.23+dfsg-1
`org-mode` Debian:14	before 9.6.23+dfsg-1	9.6.23+dfsg-1
`emacs` Mageia:9 From an advisory covering 4 CVEs	before 28.2-10.1.mga9	28.2-10.1.mga9
`emacs24` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 24.5+1-1ubuntu224.5+1-1ubuntu424.5+1-1ubuntu524.5+1-1ubuntu624.5+1-1ubuntu7 Show 6 moreShow less 24.5+1-6ubuntu124.5+1-6ubuntu1.124.5+1-6ubuntu1.1+esm124.5+1-6ubuntu1.1+esm224.5+1-6ubuntu1.1+esm324.5+1-6ubuntu1.1+esm4	None known

Show 24 moreShow less

Affected packages
Package	Affected	Fixed
`xemacs21` Ubuntu:16.04:LTS	All versions, plus listed versions 21.4.22-4ubuntu321.4.22-14ubuntu1	None known
`xemacs21-packages` Ubuntu:16.04:LTS	All versions, plus listed versions 2009.02.17.dfsg.2-2	None known
`emacs25` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 25.2+1-625.2+1-6ubuntu0.1~esm2	None known
`xemacs21` Ubuntu:18.04:LTS	All versions, plus listed versions 21.4.24-4ubuntu121.4.24-5ubuntu1	None known
`xemacs21-packages` Ubuntu:18.04:LTS	All versions, plus listed versions 2009.02.17.dfsg.2-4	None known
`xemacs21` Ubuntu:20.04:LTS	All versions, plus listed versions 21.4.24-8build121.4.24-9	None known
`xemacs21-packages` Ubuntu:20.04:LTS	All versions, plus listed versions 2009.02.17.dfsg.2-42009.02.17.dfsg.2-5	None known
`xemacs21` Ubuntu:22.04:LTS	All versions, plus listed versions 21.4.24-9ubuntu2	None known
`xemacs21-packages` Ubuntu:22.04:LTS	All versions, plus listed versions 2009.02.17.dfsg.2-5	None known
`org-mode` Ubuntu:Pro:22.04:LTS	before 9.5.2+dfsh-4ubuntu0.1~esm1, plus listed versions 9.4.0+dfsg-19.5.2+dfsh-19.5.2+dfsh-29.5.2+dfsh-39.5.2+dfsh-4	9.5.2+dfsh-4ubuntu0.1~esm1
`xemacs21` Ubuntu:24.04:LTS	All versions, plus listed versions 21.4.24-1221.4.24-12build221.4.24-12build3	None known
`xemacs21-packages` Ubuntu:24.04:LTS	All versions, plus listed versions 2009.02.17.dfsg.3-22009.02.17.dfsg.3-3	None known
`org-mode` Ubuntu:Pro:24.04:LTS	before 9.6.10+dfsg-1ubuntu0.1~esm1, plus listed versions 9.6.7+dfsg-19.6.10+dfsg-1	9.6.10+dfsg-1ubuntu0.1~esm1
`xemacs21` Ubuntu:25.10	All versions, plus listed versions 21.4.24-12build3	None known
`xemacs21-packages` Ubuntu:25.10	All versions, plus listed versions 2009.02.17.dfsg.3-3	None known
`xemacs21` Ubuntu:26.10	All versions, plus listed versions 21.4.24-12build3	None known
`xemacs21-packages` Ubuntu:26.10	All versions, plus listed versions 2009.02.17.dfsg.3-3build1	None known
`xemacs21` Ubuntu:26.04:LTS	All versions, plus listed versions 21.4.24-12build3	None known
`xemacs21-packages` Ubuntu:26.04:LTS	All versions, plus listed versions 2009.02.17.dfsg.3-32009.02.17.dfsg.3-3build1	None known
`org-mode` Ubuntu:Pro:16.04:LTS From an advisory covering 4 CVEs	before 8.3.3-2ubuntu0.1~esm1, plus listed versions 8.2.10-18.3.1-28.3.2-18.3.3-18.3.3-2	8.3.3-2ubuntu0.1~esm1
`org-mode` Ubuntu:Pro:18.04:LTS From an advisory covering 4 CVEs	before 9.1.6+dfsg-1ubuntu0.1~esm1, plus listed versions 9.0.9+dfsg-39.1.2+dfsg-29.1.5+dfsg-19.1.6+dfsg-1	9.1.6+dfsg-1ubuntu0.1~esm1
`org-mode` Ubuntu:Pro:20.04:LTS From an advisory covering 4 CVEs	before 9.3.1+dfsg-1ubuntu0.1~esm1, plus listed versions 9.2.3+dfsg-19.3+dfsg-19.3+dfsg-29.3.1+dfsg-1	9.3.1+dfsg-1ubuntu0.1~esm1
`org-mode` Ubuntu:Pro:22.04:LTS From an advisory covering 4 CVEs	before 9.5.2+dfsh-4ubuntu0.1~esm1, plus listed versions 9.4.0+dfsg-19.5.2+dfsh-19.5.2+dfsh-29.5.2+dfsh-39.5.2+dfsh-4	9.5.2+dfsh-4ubuntu0.1~esm1
`org-mode` Ubuntu:Pro:24.04:LTS From an advisory covering 4 CVEs	before 9.6.10+dfsg-1ubuntu0.1~esm1, plus listed versions 9.6.7+dfsg-19.6.10+dfsg-1	9.6.10+dfsg-1ubuntu0.1~esm1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-30202 is a high vulnerability (CVSS 7.8) in Gnu Emacs, published March 25, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.10%, the 65th percentile. Fixed in emacs 29.3-1.

References

Show 14 moreShow less