{"id":"CVE-2023-27986","aliases":["ALPINE-CVE-2023-27986","AZL-25603","DEBIAN-CVE-2023-27986","EUVD-2023-31712","GHSA-whwp-m746-hx6w","UBUNTU-CVE-2023-27986","openSUSE-SU-2024:12777-1"],"status":"published","title":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections...","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. It is fixed in 29.0.90.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00472,"percentile":0.41307,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2023-03-09T00:00:00Z","modified":"2026-11-03T06:32:42Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"emacs","fixed_in":["28.2-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"emacs","fixed_in":["28.2-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"emacs","fixed_in":["28.2-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"emacs","fixed_in":["28.2-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"emacs","fixed_in":["28.2-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"emacs","fixed_in":["28.2-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"emacs","fixed_in":["28.2-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"emacs","fixed_in":["28.2-r6"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"emacs","fixed_in":["28.2-4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"emacs","fixed_in":["1:28.2+1-13"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"emacs","fixed_in":["1:28.2+1-13"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"emacs","fixed_in":["1:28.2+1-13"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1"},{"fixed":"28.2-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1"},{"fixed":"28.2-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1"},{"fixed":"28.2-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1"},{"fixed":"28.2-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1"},{"fixed":"28.2-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1"},{"fixed":"28.2-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1"},{"fixed":"28.2-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"28.1"},{"fixed":"28.2-r6"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.2-4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:28.2+1-13"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:28.2+1-13"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:28.2+1-13"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.22-4ubuntu3","21.4.22-14ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-4ubuntu1","21.4.24-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-8build1","21.4.24-9"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-4","2009.02.17.dfsg.2-5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-9ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12","21.4.24-12build2","21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-2","2009.02.17.dfsg.3-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-3","2009.02.17.dfsg.3-3build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.2-3.1"}]}],"bundled":2}],"products":[{"vendor":"gnu","product":"emacs"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2023/03/08/2","tags":["x_transferred","Mailing List","Patch","fix","report"]},{"url":"http://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29\u0026id=3c1693d08b0a71d40a77e7b40c0ebc42dca2d2cc","tags":["x_transferred","Issue Tracking","Patch","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2023/03/09/1","tags":["mailing-list","x_transferred","Mailing List","Patch","fix","report"]},{"url":"https://www.gabriel.urdhr.fr/2023/06/08/emacsclient-mail-shell-elisp-injections/","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27986","tags":["web"]},{"url":"https://www.gabriel.urdhr.fr/2023/06/08/emacsclient-mail-shell-elisp-injections"},{"url":"https://github.com/advisories/GHSA-whwp-m746-hx6w"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-27986","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-27986","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-27986","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27986","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27986","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-27986","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. It is fixed in 29.0.90.","status":"published","published":"2023-03-09T00:00:00Z","modified":"2025-03-05T17:06:50.769Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:26.63732Z"}],"euvd":[{"id":"EUVD-2023-31712","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. It is fixed in 29.0.90.","status":"published","published":"2023-03-09T00:00:00Z","modified":"2025-03-05T17:06:50Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:13.774215Z"}],"ghsa":[{"id":"GHSA-whwp-m746-hx6w","title":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections...","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters.","status":"published","published":"2023-03-09T06:30:21Z","modified":"2025-03-05T18:33:06Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:00:09.656651Z"}],"nvd":[{"id":"CVE-2023-27986","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. It is fixed in 29.0.90.","status":"published","published":"2023-03-09T06:15:33.187Z","modified":"2026-06-17T05:46:19.067Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:48.342507Z"}],"osv":[{"id":"ALPINE-CVE-2023-27986","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. It is fixed in 29.0.90.","status":"published","published":"2023-03-09T06:15:33.187Z","modified":"2026-11-03T06:32:42.517700233Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"AZL-25603","title":"CVE-2023-27986 affecting package emacs for versions less than 28.2-4","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. It is fixed in 29.0.90.","status":"published","published":"2023-03-09T06:15:33Z","modified":"2026-04-21T04:23:06.887386Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"CVE-2023-27986","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. It is fixed in 29.0.90.","status":"published","published":"2023-03-09T06:15:33.187Z","modified":"2026-03-15T14:49:41.630074Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"DEBIAN-CVE-2023-27986","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. It is fixed in 29.0.90.","status":"published","published":"2023-03-09T06:15:33.187Z","modified":"2026-10-26T18:00:54.67861824Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"UBUNTU-CVE-2023-27986","description":"emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. It is fixed in 29.0.90.","status":"published","published":"2023-03-09T06:15:00Z","modified":"2026-10-17T12:57:16.532485252Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"openSUSE-SU-2024:12777-1","title":"emacs-28.2-3.1 on GA media","description":"These are all security issues fixed in the emacs-28.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:29:40.138219Z","updated_at":"2026-11-02T16:58:35.751245Z"}]}}