{"id":"CVE-2023-27985","aliases":["ALPINE-CVE-2023-27985","AZL-25581","DEBIAN-CVE-2023-27985","EUVD-2023-31711","GHSA-f5fq-43fc-vgcr","UBUNTU-CVE-2023-27985","openSUSE-SU-2024:12777-1"],"status":"published","title":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections...","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01079,"percentile":0.65335,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2023-03-09T00:00:00Z","modified":"2026-11-03T06:32:42Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"emacs","fixed_in":["28.2-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"emacs","fixed_in":["28.2-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"emacs","fixed_in":["28.2-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"emacs","fixed_in":["28.2-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"emacs","fixed_in":["28.2-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"emacs","fixed_in":["28.2-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"emacs","fixed_in":["28.2-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"emacs","fixed_in":["28.2-r5"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"emacs","fixed_in":["28.2-4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"emacs","fixed_in":["1:28.2+1-13"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"emacs","fixed_in":["1:28.2+1-13"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"emacs","fixed_in":["1:28.2+1-13"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1"},{"fixed":"28.2-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1"},{"fixed":"28.2-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1"},{"fixed":"28.2-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1"},{"fixed":"28.2-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1"},{"fixed":"28.2-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1"},{"fixed":"28.2-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1"},{"fixed":"28.2-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1"},{"fixed":"28.2-r5"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.2-4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:28.2+1-13"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:28.2+1-13"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:28.2+1-13"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.22-4ubuntu3","21.4.22-14ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-4ubuntu1","21.4.24-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-8build1","21.4.24-9"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-4","2009.02.17.dfsg.2-5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-9ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12","21.4.24-12build2","21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-2","2009.02.17.dfsg.3-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-3","2009.02.17.dfsg.3-3build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.2-3.1"}]}],"bundled":2}],"products":[{"vendor":"gnu","product":"emacs"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2023/03/08/2","tags":["x_transferred","Mailing List","Patch","fix","report"]},{"url":"http://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29\u0026id=d32091199ae5de590a83f1542a01d75fba000467","tags":["x_transferred","Issue Tracking","Patch","fix"]},{"url":"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=60204","tags":["x_transferred","Issue Tracking","Patch","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2023/03/09/1","tags":["mailing-list","x_transferred","Mailing List","Patch","fix","report"]},{"url":"https://www.gabriel.urdhr.fr/2023/06/08/emacsclient-mail-shell-elisp-injections/","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27985","tags":["web"]},{"url":"https://www.gabriel.urdhr.fr/2023/06/08/emacsclient-mail-shell-elisp-injections"},{"url":"https://github.com/advisories/GHSA-f5fq-43fc-vgcr"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-27985","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-27985","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-27985","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27985","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27986","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-27985","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90","status":"published","published":"2023-03-09T00:00:00Z","modified":"2025-03-05T16:57:02.029Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:26.63732Z"}],"euvd":[{"id":"EUVD-2023-31711","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90","status":"published","published":"2023-03-09T00:00:00Z","modified":"2025-03-05T16:57:02Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:13.774215Z"}],"ghsa":[{"id":"GHSA-f5fq-43fc-vgcr","title":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections...","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification.","status":"published","published":"2023-03-09T06:30:21Z","modified":"2025-03-05T18:32:03Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:00:09.656651Z"}],"nvd":[{"id":"CVE-2023-27985","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90","status":"published","published":"2023-03-09T06:15:32.987Z","modified":"2026-06-17T05:46:18.867Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:48.342507Z"}],"osv":[{"id":"ALPINE-CVE-2023-27985","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90","status":"published","published":"2023-03-09T06:15:32.987Z","modified":"2026-11-03T06:32:42.507212249Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"AZL-25581","title":"CVE-2023-27985 affecting package emacs for versions less than 28.2-4","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90","status":"published","published":"2023-03-09T06:15:32Z","modified":"2026-04-21T04:23:06.591746Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"CVE-2023-27985","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90","status":"published","published":"2023-03-09T06:15:32.987Z","modified":"2026-03-15T22:32:38.324323Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"DEBIAN-CVE-2023-27985","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90","status":"published","published":"2023-03-09T06:15:32.987Z","modified":"2026-10-26T18:01:47.104969876Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"UBUNTU-CVE-2023-27985","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90","status":"published","published":"2023-03-09T06:15:00Z","modified":"2026-10-17T12:57:17.142469912Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"openSUSE-SU-2024:12777-1","title":"emacs-28.2-3.1 on GA media","description":"These are all security issues fixed in the emacs-28.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:29:40.138219Z","updated_at":"2026-11-02T16:58:35.751245Z"}]}}