Every CVE Search/ Get API key

CVE-2023-2491

A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the ...

7.8 HighFix available

A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.46%Up 0.4 points since May 18, 2023
90%50%10%1%

What each source reports

NVD Score used 7.8

A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Record
CVE-2023-2491
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77
Updated
2026-11-02
CVE List 7.8

A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Record
CVE-2023-2491
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77
Updated
2026-11-02
EUVDEUVD-2023-33975 7.8

A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Record
EUVD-2023-33975
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-2hj6-9wp7-hvmh 7.8

A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the ...

A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Record
GHSA-2hj6-9wp7-hvmh
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77
Updated
2026-11-02
OSVRHSA-2023:2626 7.8

Red Hat Security Advisory: emacs security update

Record
RHSA-2023:2626
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:3104 7.8

Red Hat Security Advisory: emacs security update

Record
RHSA-2023:3104
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2023:2626 No score

Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.

Security Fix(es):

  • emacs: Regression of CVE-2023-28617 fixes in the AlmaLinux (CVE-2023-2491)
  • emacs: command execution via shell metacharacters (CVE-2022-48337)
  • emacs: local command injection in ruby-mode.el (CVE-2022-48338)
  • emacs: command injection vulnerability in htmlfontify.el (CVE-2022-48339)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:2626
Updated
2026-11-02
OSVALSA-2023:3104 No score

Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.

Security Fix(es):

  • emacs: Regression of CVE-2023-28617 fixes in the AlmaLinux (CVE-2023-2491)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:3104
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
emacs
AlmaLinux:9
 before 1:27.2-8.el9_2.1
1:27.2-8.el9_2.1
emacs-common
AlmaLinux:9
 before 1:27.2-8.el9_2.1
1:27.2-8.el9_2.1
emacs-filesystem
AlmaLinux:9
 before 1:27.2-8.el9_2.1
1:27.2-8.el9_2.1
emacs-lucid
AlmaLinux:9
 before 1:27.2-8.el9_2.1
1:27.2-8.el9_2.1
emacs-nox
AlmaLinux:9
 before 1:27.2-8.el9_2.1
1:27.2-8.el9_2.1
emacs
AlmaLinux:8
 before 1:26.1-10.el8_8.2
1:26.1-10.el8_8.2
emacs-common
AlmaLinux:8
 before 1:26.1-10.el8_8.2
1:26.1-10.el8_8.2
emacs-filesystem
AlmaLinux:8
 before 1:26.1-10.el8_8.2
1:26.1-10.el8_8.2
emacs-lucid
AlmaLinux:8
 before 1:26.1-10.el8_8.2
1:26.1-10.el8_8.2
emacs-nox
AlmaLinux:8
 before 1:26.1-10.el8_8.2
1:26.1-10.el8_8.2
Show 23 moreShow less
Affected packages
PackageAffectedFixed
emacs-terminal
AlmaLinux:8
 before 1:26.1-10.el8_8.2
1:26.1-10.el8_8.2
emacs
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-8.el9_2.1
1:27.2-8.el9_2.1
emacs-common
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-8.el9_2.1
1:27.2-8.el9_2.1
emacs-common-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-8.el9_2.1
1:27.2-8.el9_2.1
emacs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-8.el9_2.1
1:27.2-8.el9_2.1
emacs-debugsource
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-8.el9_2.1
1:27.2-8.el9_2.1
emacs-filesystem
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-8.el9_2.1
1:27.2-8.el9_2.1
emacs-lucid
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-8.el9_2.1
1:27.2-8.el9_2.1
emacs-lucid-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-8.el9_2.1
1:27.2-8.el9_2.1
emacs-nox
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-8.el9_2.1
1:27.2-8.el9_2.1
emacs-nox-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:27.2-8.el9_2.1
1:27.2-8.el9_2.1
emacs
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-10.el8_8.2
1:26.1-10.el8_8.2
emacs-common
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-10.el8_8.2
1:26.1-10.el8_8.2
emacs-common-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-10.el8_8.2
1:26.1-10.el8_8.2
emacs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-10.el8_8.2
1:26.1-10.el8_8.2
emacs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-10.el8_8.2
1:26.1-10.el8_8.2
emacs-lucid
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-10.el8_8.2
1:26.1-10.el8_8.2
emacs-lucid-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-10.el8_8.2
1:26.1-10.el8_8.2
emacs-nox
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-10.el8_8.2
1:26.1-10.el8_8.2
emacs-nox-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-10.el8_8.2
1:26.1-10.el8_8.2
emacs-terminal
Red Hat:enterprise_linux:8::appstream
 before 1:26.1-10.el8_8.2
1:26.1-10.el8_8.2
emacs
Red Hat:enterprise_linux:8::baseos
 before 1:26.1-10.el8_8.2
1:26.1-10.el8_8.2
emacs-filesystem
Red Hat:enterprise_linux:8::baseos
 before 1:26.1-10.el8_8.2
1:26.1-10.el8_8.2

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-2491 is a high vulnerability (CVSS 7.8) in Gnu Emacs, published May 9, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in emacs 1:27.2-8.el9_2.1.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open