{"id":"CVE-2022-48337","aliases":["ALSA-2023:2626","ALSA-2023:7083","AZL-13702","DEBIAN-CVE-2022-48337","DLA-3416-1","DSA-5360-1","EUVD-2022-51037","GHSA-8hw9-jqh3-h2rx","MGASA-2023-0081","OESA-2023-1148","RHSA-2023:2626","RHSA-2023:7083","RHSA-2024:1103","RHSA-2024:1408","RLSA-2023:7083","SUSE-SU-2023:0597-1","SUSE-SU-2023:0598-1","SUSE-SU-2023:0675-1","UBUNTU-CVE-2022-48337","USN-7027-1","openSUSE-SU-2024:12721-1"],"status":"published","title":"GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name...","description":"GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the \"etags -u *\" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01617,"percentile":0.76228,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77","CWE-78"],"published":"2023-02-20T00:00:00Z","modified":"2026-11-03T08:03:56Z","fixes":[{"ecosystem":"Azure Linux:2","package":"emacs","fixed_in":["28.2-4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"emacs","fixed_in":["1:28.2+1-11"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"emacs","fixed_in":["1:28.2+1-11"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"emacs","fixed_in":["1:28.2+1-11"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"emacs24","fixed_in":["24.5+1-6ubuntu1.1+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"emacs25","fixed_in":["25.2+1-6ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"emacs","fixed_in":["1:26.3+1-1ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"emacs","fixed_in":["1:27.1+1-3ubuntu5.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"emacs-terminal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:2","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.2-4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:28.2+1-11"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:28.2+1-11"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:28.2+1-11"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1+1-3.2+deb10u4"}]}],"versions":["1:26.1+1-3.2","1:26.1+1-3.2+deb10u1","1:26.1+1-3.2+deb10u2","1:26.1+1-3.2+deb10u3"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.1+1-3.1+deb11u2"}]}],"versions":["1:27.1+1-3.1","1:27.1+1-3.1+deb11u1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:8","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.1-1.3.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.1-10.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.1-8.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-9.oe2203sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-9.oe2203sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-lucid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"emacs-nox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.2-8.el9_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-lucid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-nox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"emacs-terminal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-7.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-7.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"emacs-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-7.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"emacs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-7.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"emacs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-7.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-7.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"emacs-lucid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-7.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-7.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"emacs-nox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-7.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"emacs-terminal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-7.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-7.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-7.el8_6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-10.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"emacs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-10.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"emacs-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-10.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"emacs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-10.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"emacs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-10.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"emacs-lucid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-10.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"emacs-lucid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-10.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"emacs-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-10.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"emacs-nox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-10.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"emacs-terminal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-10.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-10.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"emacs-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-10.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.1-11.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3-25.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3-25.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3-25.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3-25.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3-25.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3-25.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3-25.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.3-25.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.2-150400.3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3-150000.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3-150000.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3-150000.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3-150000.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3-150000.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3-150000.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3-150000.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3-150000.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3-150000.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3-150000.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3-150000.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3-150000.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3-150000.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3-150000.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3-150000.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"emacs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.5+1-6ubuntu1.1+esm4"}]}],"versions":["24.5+1-1ubuntu2","24.5+1-1ubuntu4","24.5+1-1ubuntu5","24.5+1-1ubuntu6","24.5+1-1ubuntu7","24.5+1-6ubuntu1","24.5+1-6ubuntu1.1","24.5+1-6ubuntu1.1+esm1","24.5+1-6ubuntu1.1+esm2","24.5+1-6ubuntu1.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.22-4ubuntu3","21.4.22-14ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"emacs25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.2+1-6ubuntu0.1~esm2"}]}],"versions":["25.2+1-6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-4ubuntu1","21.4.24-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.3+1-1ubuntu2+esm1"}]}],"versions":["1:26.3+1-1ubuntu1","1:26.3+1-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-8build1","21.4.24-9"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-4","2009.02.17.dfsg.2-5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.1+1-3ubuntu5.2"}]}],"versions":["1:27.1+1-3ubuntu3","1:27.1+1-3ubuntu5","1:27.1+1-3ubuntu5.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-9ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12","21.4.24-12build2","21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-2","2009.02.17.dfsg.3-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-3","2009.02.17.dfsg.3-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"emacs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.5+1-6ubuntu1.1+esm4"}]}],"versions":["24.5+1-1ubuntu2","24.5+1-1ubuntu4","24.5+1-1ubuntu5","24.5+1-1ubuntu6","24.5+1-1ubuntu7","24.5+1-6ubuntu1","24.5+1-6ubuntu1.1","24.5+1-6ubuntu1.1+esm1","24.5+1-6ubuntu1.1+esm2","24.5+1-6ubuntu1.1+esm3"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"emacs25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.2+1-6ubuntu0.1~esm2"}]}],"versions":["25.2+1-6"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.3+1-1ubuntu2+esm1"}]}],"versions":["1:26.3+1-1ubuntu1","1:26.3+1-1ubuntu2"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.1+1-3ubuntu5.2"}]}],"versions":["1:27.1+1-3ubuntu3","1:27.1+1-3ubuntu5","1:27.1+1-3ubuntu5.1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.3+1-1ubuntu2+esm1"}]}],"versions":["1:29.1+1-5ubuntu1","1:29.2+1-1ubuntu1","1:29.2+1-2ubuntu4","1:29.3+1-1ubuntu2"],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.2-2.1"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"gnu","product":"emacs"}],"references":[{"url":"https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=01a4035c869b91c153af9a9132c87adb7669ea1c","tags":["x_transferred","Patch","web"]},{"url":"https://www.debian.org/security/2023/dsa-5360","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/05/msg00008.html","tags":["mailing-list","x_transferred","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6HDBUQNAH2WL4MHWCTUZLN7NGF7CHTK/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FLPQ4K6H2S5TY3L5UDN4K4B3L5RQJYQ6/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48337","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FLPQ4K6H2S5TY3L5UDN4K4B3L5RQJYQ6"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6HDBUQNAH2WL4MHWCTUZLN7NGF7CHTK"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FLPQ4K6H2S5TY3L5UDN4K4B3L5RQJYQ6"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6HDBUQNAH2WL4MHWCTUZLN7NGF7CHTK"},{"url":"https://github.com/advisories/GHSA-8hw9-jqh3-h2rx"},{"url":"https://access.redhat.com/errata/RHSA-2023:2626","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-48337","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-48338","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-48339","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-2491","tags":["report"]},{"url":"https://bugzilla.redhat.com/2171987","tags":["report"]},{"url":"https://bugzilla.redhat.com/2171988","tags":["report"]},{"url":"https://bugzilla.redhat.com/2171989","tags":["report"]},{"url":"https://bugzilla.redhat.com/2192873","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-2626.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7083","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-7083.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48337.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-48337","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0081.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31593","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48339","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48338","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2171987","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2171988","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2171989","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2192873","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2626.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-48337","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-48338","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-48339","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-2491","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2491","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.9_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7083.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1103","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2149380","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1103.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45939","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45939","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45939","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1408","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1408.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:7083","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230597-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208512","tags":["report"]},{"url":"https://bugzilla.suse.com/1208515","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48339","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230598-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208514","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48338","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230675-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-48337","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7027-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-45939","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-48338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-48339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-28617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-30203","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-30204","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-30205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-39331","tags":["report"]},{"url":"https://launchpad.net/bugs/2070418","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-48337","description":"GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the \"etags -u *\" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.","status":"published","published":"2023-02-20T00:00:00Z","modified":"2025-03-18T15:30:23.044Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:33.574107Z"}],"euvd":[{"id":"EUVD-2022-51037","description":"GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the \"etags -u *\" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.","status":"published","published":"2023-02-20T00:00:00Z","modified":"2025-03-18T15:30:23Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:53:00.464245Z"}],"ghsa":[{"id":"GHSA-8hw9-jqh3-h2rx","title":"GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name...","description":"GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the \"etags -u *\" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.","status":"published","published":"2023-02-21T00:30:20Z","modified":"2025-03-18T18:31:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T15:00:20.689988Z"}],"nvd":[{"id":"CVE-2022-48337","description":"GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the \"etags -u *\" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.","status":"published","published":"2023-02-20T23:15:12.243Z","modified":"2026-06-17T05:15:11.137Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:36.601381Z"}],"osv":[{"id":"AZL-13702","title":"CVE-2022-48337 affecting package emacs for versions less than 28.2-4","description":"GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the \"etags -u *\" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.","status":"published","published":"2023-02-20T23:15:12Z","modified":"2026-04-21T04:22:57.346249Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"CVE-2022-48337","description":"GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the \"etags -u *\" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.","status":"published","published":"2023-02-20T00:00:00Z","modified":"2026-10-31T10:45:13.907350896Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:27.776402Z"},{"id":"DEBIAN-CVE-2022-48337","description":"GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the \"etags -u *\" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.","status":"published","published":"2023-02-20T23:15:12.243Z","modified":"2026-11-03T08:03:56.785973876Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:23:34.488036Z"},{"id":"OESA-2023-1148","title":"emacs security update","description":"Emacs is the extensible, customizable, self-documenting real-time display editor.At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing. And it is an entire ecosystem of functionality beyond text editing,including a project planner, mail and news reader, debugger interface, calendar, and more.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.(CVE-2022-48339)\r\n\r\nAn issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed.(CVE-2022-48338)\r\n\r\nGNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the \u0026quot;etags -u *\u0026quot; command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.(CVE-2022-48337)","status":"published","published":"2023-03-04T11:05:37Z","modified":"2026-08-18T01:17:38.630043076Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2023:2626","title":"Red Hat Security Advisory: emacs security update","status":"published","published":"2024-09-16T11:26:38Z","modified":"2026-01-22T10:42:25.724723Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:7083","title":"Red Hat Security Advisory: emacs security update","status":"published","published":"2024-09-16T11:27:07Z","modified":"2026-06-26T12:21:19.482788095Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2024:1103","title":"Red Hat Security Advisory: emacs security update","status":"published","published":"2024-09-16T11:27:16Z","modified":"2026-06-26T12:22:36.747271304Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1408","title":"Red Hat Security Advisory: emacs security update","status":"published","published":"2024-09-16T11:27:25Z","modified":"2026-06-26T12:22:36.773199505Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RLSA-2023:7083","title":"Moderate: emacs security update","description":"GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.\n\nSecurity Fix(es):\n\n* emacs: command execution via shell metacharacters (CVE-2022-48337)\n\n* emacs: command injection vulnerability in htmlfontify.el (CVE-2022-48339)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.9 Release Notes linked from the References section.","status":"published","published":"2026-06-25T12:00:44.845974Z","modified":"2026-06-25T12:30:05.638647642Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2022-48337","description":"GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the \"etags -u *\" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.","status":"published","published":"2023-02-20T23:15:00Z","modified":"2026-10-17T12:55:59.683038185Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"ALSA-2023:2626","title":"Important: emacs security update","description":"GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.\n\nSecurity Fix(es):\n\n* emacs: Regression of CVE-2023-28617 fixes in the AlmaLinux (CVE-2023-2491)\n* emacs: command execution via shell metacharacters (CVE-2022-48337)\n* emacs: local command injection in ruby-mode.el (CVE-2022-48338)\n* emacs: command injection vulnerability in htmlfontify.el (CVE-2022-48339)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-05-09T00:00:00Z","modified":"2026-10-29T11:30:55.950988726Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:7083","title":"Moderate: emacs security update","description":"GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.\n\nSecurity Fix(es):\n\n* emacs: command execution via shell metacharacters (CVE-2022-48337)\n* emacs: command injection vulnerability in htmlfontify.el (CVE-2022-48339)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-14T00:00:00Z","modified":"2026-10-29T11:02:19.196505248Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"DLA-3416-1","title":"emacs - security update","status":"published","published":"2023-05-10T00:00:00Z","modified":"2026-03-09T01:17:49.084084Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5360-1","title":"emacs - security update","status":"published","published":"2023-02-23T00:00:00Z","modified":"2026-03-09T02:11:38.895162Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2023-0081","title":"Updated emacs packages fix security vulnerability","description":"GNU Emacs through 28.2 allows attackers to execute commands via shell\nmetacharacters in the name of a source-code file, because lib-src/etags.c\nuses the system C library function in its implementation of the etags\nprogram. For example, a victim may use the \"etags -u *\" command (suggested\nin the etags documentation) in a situation where the current working\ndirectory has contents that depend on untrusted input. (CVE-2022-48337)\n\nAn issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the\nruby-find-library-file function has a local command injection\nvulnerability. The ruby-find-library-file function is an interactive\nfunction, and bound to C-c C-f. Inside the function, the external command\ngem is called through shell-command-to-string, but the feature-name\nparameters are not escaped. Thus, malicious Ruby source files may cause\ncommands to be executed. (CVE-2022-48338)\n\nAn issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a\ncommand injection vulnerability. In the hfy-istext-command function, the\nparameter file and parameter srcdir come from external input, and\nparameters are not escaped. If a file name or directory name contains\nshell metacharacters, code may be executed. (CVE-2022-48339)\n","status":"published","published":"2023-03-01T21:14:31Z","modified":"2026-04-16T04:43:30.002848587Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12721-1","title":"emacs-28.2-2.1 on GA media","description":"These are all security issues fixed in the emacs-28.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:03:34.453309Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2023:0597-1","title":"Security update for emacs","description":"This update for emacs fixes the following issues:\n\n  - CVE-2022-48337: Fixed etags local command injection vulnerability (bsc#1208515).\n  - CVE-2022-48339: Fixed htmlfontify.el command injection vulnerability (bsc#1208512).\n","status":"published","published":"2023-03-02T11:23:15Z","modified":"2026-02-04T04:30:57.778719Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0598-1","title":"Security update for emacs","description":"This update for emacs fixes the following issues:\n\n  - CVE-2022-48337: Fixed etags local command injection vulnerability (bsc#1208515).\n  - CVE-2022-48339: Fixed htmlfontify.el command injection vulnerability (bsc#1208512).\n  - CVE-2022-48338: Fixed ruby-mode.el local command injection vulnerability (bsc#1208514).\n","status":"published","published":"2023-03-02T11:23:58Z","modified":"2026-02-04T03:48:02.421851Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0675-1","title":"Security update for emacs","description":"This update for emacs fixes the following issues:\n\n  - CVE-2022-48337: Fixed etags local command injection vulnerability (bsc#1208515).\n  - CVE-2022-48339: Fixed htmlfontify.el command injection vulnerability (bsc#1208512).\n","status":"published","published":"2023-03-08T13:31:28Z","modified":"2026-02-04T04:17:41.91226Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"USN-7027-1","title":"emacs, emacs24, emacs25 vulnerabilities","description":"It was discovered that Emacs incorrectly handled input sanitization. An\nattacker could possibly use this issue to execute arbitrary commands. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04\nLTS. (CVE-2022-45939)\n\nXi Lu discovered that Emacs incorrectly handled input sanitization. An\nattacker could possibly use this issue to execute arbitrary commands. This\nissue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS\nand Ubuntu 22.04 LTS. (CVE-2022-48337)\n\nXi Lu discovered that Emacs incorrectly handled input sanitization. An\nattacker could possibly use this issue to execute arbitrary commands. This\nissue only affected Ubuntu 22.04 LTS. (CVE-2022-48338)\n\nXi Lu discovered that Emacs incorrectly handled input sanitization. An\nattacker could possibly use this issue to execute arbitrary commands. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04\nLTS. (CVE-2022-48339)\n\nIt was discovered that Emacs incorrectly handled filename sanitization. An\nattacker could possibly use this issue to execute arbitrary commands. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04\nLTS. (CVE-2023-28617)\n\nIt was discovered that Emacs incorrectly handled certain crafted files. An\nattacker could possibly use this issue to crash the program, resulting in\na denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-30203,\nCVE-2024-30204, CVE-2024-30205)\n\nIt was discovered that Emacs incorrectly handled certain crafted files. An\nattacker could possibly use this issue to execute arbitrary commands.\n(CVE-2024-39331)\n","status":"published","published":"2024-09-19T17:16:05Z","modified":"2026-06-25T13:32:29.065193892Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}