Every CVE Search/ Get API key

CVE-2026-108976

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename...

7.8 HighFix available

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.65%Up 0.1 points since Oct 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.8

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

Record
CVE-2026-108976
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-184
Updated
2026-11-02
EUVDEUVD-2026-97124 7.8

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

Record
EUVD-2026-97124
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-f2f9-wp9v-23mf 7.8

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename...

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

Record
GHSA-f2f9-wp9v-23mf
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-184
Updated
2026-11-02
NVD 7.8

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

Record
CVE-2026-108976
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-184
Updated
2026-11-02
OSVOESA-2026-4648 7.8

emacs security update

Emacs is the extensible, customizable, self-documenting real-time display editor. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing. And it is an entire ecosystem of functionality beyond text editing, including a project planner, mail and news reader, debugger interface, calendar, and more.

Security Fix(es):

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.(CVE-2026-108976)

Record
OESA-2026-4648
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-4649 7.8

emacs security update

Emacs is the extensible, customizable, self-documenting real-time display editor. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing. And it is an entire ecosystem of functionality beyond text editing, including a project planner, mail and news reader, debugger interface, calendar, and more.

Security Fix(es):

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.(CVE-2026-108976)

Record
OESA-2026-4649
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVOESA-2026-4650 7.8

emacs security update

Emacs is the extensible, customizable, self-documenting real-time display editor. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing. And it is an entire ecosystem of functionality beyond text editing, including a project planner, mail and news reader, debugger interface, calendar, and more.

Security Fix(es):

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.(CVE-2026-108976)

Record
OESA-2026-4650
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-108976 7.8

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

Record
UBUNTU-CVE-2026-108976
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-107949 No score

CVE-2026-108976 affecting package emacs 29.4-7

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

Record
AZL-107949
Updated
2026-11-05
OSVCLSA-2026-1792080478 No score

emacs: Fix of 3 CVEs

  • CVE-2026-77219: fix integer overflow in PBM image loader
  • CVE-2026-79992: restrict Tramp user names to prevent shell command injection
  • CVE-2026-108976: strengthen Tramp user and host name validation
Record
CLSA-2026-1792080478
Updated
2026-11-02
OSVCLSA-2026-1792478726 No score

emacs: Fix of 2 CVEs

  • CVE-2026-108976: fix Tramp user and host name validation
  • CVE-2026-79992: strengthen Tramp user and host name limitations
Record
CLSA-2026-1792478726
Updated
2026-11-02
OSVCLSA-2026-1792478956 No score

emacs: Fix of 2 CVEs

  • CVE-2026-108976: fix Tramp user and host name validation
  • CVE-2026-79992: strengthen Tramp user and host name limitations
Record
CLSA-2026-1792478956
Updated
2026-11-02
OSVSUSE-SU-2026:4893-1 No score

Security update for emacs

This update for emacs fixes the following issues:

  • CVE-2026-79992: zero-click local command execution via TRAMP (bsc#1275927).
  • CVE-2026-108976: flawed username input regex validation in TRAMP can cause arbitrary OS command injection (bsc#1284345, bsc#1284990).
Record
SUSE-SU-2026:4893-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
emacs
Azure Linux:3
 through 29.4-7 None known
emacs
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:27.2-8.el9_2.1.tuxcare.els7
1:27.2-8.el9_2.1.tuxcare.els7
emacs-common
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:27.2-8.el9_2.1.tuxcare.els7
1:27.2-8.el9_2.1.tuxcare.els7
emacs-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:27.2-8.el9_2.1.tuxcare.els7
1:27.2-8.el9_2.1.tuxcare.els7
emacs-filesystem
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:27.2-8.el9_2.1.tuxcare.els7
1:27.2-8.el9_2.1.tuxcare.els7
emacs-lucid
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:27.2-8.el9_2.1.tuxcare.els7
1:27.2-8.el9_2.1.tuxcare.els7
emacs-nox
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:27.2-8.el9_2.1.tuxcare.els7
1:27.2-8.el9_2.1.tuxcare.els7
emacs-terminal
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 1:27.2-8.el9_2.1.tuxcare.els7
1:27.2-8.el9_2.1.tuxcare.els7
emacs
TuxCare:RHEL:7
From an advisory covering 2 CVEs
 before 1:24.3-23.0.1.el7_9.1.tuxcare.els3
1:24.3-23.0.1.el7_9.1.tuxcare.els3
emacs-common
TuxCare:RHEL:7
From an advisory covering 2 CVEs
 before 1:24.3-23.0.1.el7_9.1.tuxcare.els3
1:24.3-23.0.1.el7_9.1.tuxcare.els3
Show 46 moreShow less
Affected packages
PackageAffectedFixed
emacs-el
TuxCare:RHEL:7
From an advisory covering 2 CVEs
 before 1:24.3-23.0.1.el7_9.1.tuxcare.els3
1:24.3-23.0.1.el7_9.1.tuxcare.els3
emacs-filesystem
TuxCare:RHEL:7
From an advisory covering 2 CVEs
 before 1:24.3-23.0.1.el7_9.1.tuxcare.els3
1:24.3-23.0.1.el7_9.1.tuxcare.els3
emacs-nox
TuxCare:RHEL:7
From an advisory covering 2 CVEs
 before 1:24.3-23.0.1.el7_9.1.tuxcare.els3
1:24.3-23.0.1.el7_9.1.tuxcare.els3
emacs-terminal
TuxCare:RHEL:7
From an advisory covering 2 CVEs
 before 1:24.3-23.0.1.el7_9.1.tuxcare.els3
1:24.3-23.0.1.el7_9.1.tuxcare.els3
emacs
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 1:24.3-23.0.1.el7_9.1.tuxcare.els3
1:24.3-23.0.1.el7_9.1.tuxcare.els3
emacs-common
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 1:24.3-23.0.1.el7_9.1.tuxcare.els3
1:24.3-23.0.1.el7_9.1.tuxcare.els3
emacs-el
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 1:24.3-23.0.1.el7_9.1.tuxcare.els3
1:24.3-23.0.1.el7_9.1.tuxcare.els3
emacs-filesystem
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 1:24.3-23.0.1.el7_9.1.tuxcare.els3
1:24.3-23.0.1.el7_9.1.tuxcare.els3
emacs-nox
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 1:24.3-23.0.1.el7_9.1.tuxcare.els3
1:24.3-23.0.1.el7_9.1.tuxcare.els3
emacs-terminal
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 1:24.3-23.0.1.el7_9.1.tuxcare.els3
1:24.3-23.0.1.el7_9.1.tuxcare.els3
emacs
openEuler:24.03-LTS-SP1
 before 29.1-11.oe2403sp1
29.1-11.oe2403sp1
emacs
openEuler:24.03-LTS-SP3
 before 29.1-11.oe2403sp3
29.1-11.oe2403sp3
emacs
openEuler:24.03-LTS-SP4
 before 29.1-12.oe2403sp4
29.1-12.oe2403sp4
emacs
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 2 CVEs
 before 27.2-150400.3.37.1
27.2-150400.3.37.1
emacs
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 2 CVEs
 before 27.2-150400.3.37.1
27.2-150400.3.37.1
emacs
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 2 CVEs
 before 27.2-150400.3.37.1
27.2-150400.3.37.1
emacs
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 27.2-150400.3.37.1
27.2-150400.3.37.1
emacs
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 2 CVEs
 before 27.2-150400.3.37.1
27.2-150400.3.37.1
emacs
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 27.2-150400.3.37.1
27.2-150400.3.37.1
emacs
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 2 CVEs
 before 27.2-150400.3.37.1
27.2-150400.3.37.1
emacs
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 2 CVEs
 before 27.2-150400.3.37.1
27.2-150400.3.37.1
emacs
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 2 CVEs
 before 27.2-150400.3.37.1
27.2-150400.3.37.1
emacs
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 2 CVEs
 before 27.2-150400.3.37.1
27.2-150400.3.37.1
emacs
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 2 CVEs
 before 27.2-150400.3.37.1
27.2-150400.3.37.1
emacs
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 2 CVEs
 before 27.2-150400.3.37.1
27.2-150400.3.37.1
emacs24
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
24.5+1-1ubuntu224.5+1-1ubuntu424.5+1-1ubuntu524.5+1-1ubuntu624.5+1-1ubuntu7
Show 6 moreShow less
24.5+1-6ubuntu124.5+1-6ubuntu1.124.5+1-6ubuntu1.1+esm124.5+1-6ubuntu1.1+esm224.5+1-6ubuntu1.1+esm324.5+1-6ubuntu1.1+esm4
 None known
xemacs21
Ubuntu:16.04:LTS
 All versions, plus listed versions
21.4.22-4ubuntu321.4.22-14ubuntu1
 None known
xemacs21-packages
Ubuntu:16.04:LTS
 All versions, plus listed versions
2009.02.17.dfsg.2-2
 None known
emacs25
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
25.2+1-625.2+1-6ubuntu0.1~esm2
 None known
xemacs21
Ubuntu:18.04:LTS
 All versions, plus listed versions
21.4.24-4ubuntu121.4.24-5ubuntu1
 None known
xemacs21-packages
Ubuntu:18.04:LTS
 All versions, plus listed versions
2009.02.17.dfsg.2-4
 None known
emacs
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1:26.3+1-1ubuntu11:26.3+1-1ubuntu21:26.3+1-1ubuntu2+esm11:26.3+1-1ubuntu2+esm2
 None known
xemacs21
Ubuntu:20.04:LTS
 All versions, plus listed versions
21.4.24-8build121.4.24-9
 None known
xemacs21-packages
Ubuntu:20.04:LTS
 All versions, plus listed versions
2009.02.17.dfsg.2-42009.02.17.dfsg.2-5
 None known
xemacs21
Ubuntu:22.04:LTS
 All versions, plus listed versions
21.4.24-9ubuntu2
 None known
xemacs21-packages
Ubuntu:22.04:LTS
 All versions, plus listed versions
2009.02.17.dfsg.2-5
 None known
emacs
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1:27.1+1-3ubuntu31:27.1+1-3ubuntu51:27.1+1-3ubuntu5.11:27.1+1-3ubuntu5.21:27.1+1-3ubuntu5.2+esm1
 None known
xemacs21
Ubuntu:24.04:LTS
 All versions, plus listed versions
21.4.24-1221.4.24-12build221.4.24-12build3
 None known
xemacs21-packages
Ubuntu:24.04:LTS
 All versions, plus listed versions
2009.02.17.dfsg.3-22009.02.17.dfsg.3-3
 None known
emacs
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1:29.1+1-5ubuntu11:29.2+1-1ubuntu11:29.2+1-2ubuntu41:29.3+1-1ubuntu21:29.3+1-1ubuntu2+esm11:29.3+1-1ubuntu2+esm31:29.3+1-1ubuntu2+esm4
 None known
emacs
Ubuntu:26.10
 All versions, plus listed versions
1:30.2+1-2ubuntu11:30.2+1-6ubuntu11:30.2+1-11ubuntu1
 None known
xemacs21
Ubuntu:26.10
 All versions, plus listed versions
21.4.24-12build3
 None known
xemacs21-packages
Ubuntu:26.10
 All versions, plus listed versions
2009.02.17.dfsg.3-3build1
 None known
xemacs21
Ubuntu:26.04:LTS
 All versions, plus listed versions
21.4.24-12build3
 None known
xemacs21-packages
Ubuntu:26.04:LTS
 All versions, plus listed versions
2009.02.17.dfsg.3-32009.02.17.dfsg.3-3build1
 None known
emacs
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
1:30.1+1-9ubuntu11:30.2+1-1ubuntu21:30.2+1-2ubuntu11:30.2+1-2ubuntu1+esm1
 None known

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-108976 is a high vulnerability (CVSS 7.8) in Gnu Emacs, published October 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. Fixed in emacs 29.1-11.oe2403sp1.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open