{"id":"CVE-2024-30202","aliases":["AZL-37082","AZL-37105","DEBIAN-CVE-2024-30202","EUVD-2024-28134","GHSA-8r8f-v2fj-h7cp","MGASA-2024-0104","UBUNTU-CVE-2024-30202","USN-7375-1"],"status":"published","title":"In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This...","description":"In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.01099,"percentile":0.65929,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2024-03-25T00:00:00Z","modified":"2026-11-02T12:02:16Z","fixes":[{"ecosystem":"Azure Linux:2","package":"emacs","fixed_in":["29.3-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"emacs","fixed_in":["29.3-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"emacs","fixed_in":["1:28.2+1-15+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"emacs","fixed_in":["1:29.3+1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"emacs","fixed_in":["1:29.3+1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"org-mode","fixed_in":["9.6.23+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"org-mode","fixed_in":["9.6.23+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"org-mode","fixed_in":["9.5.2+dfsh-4ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"org-mode","fixed_in":["9.6.10+dfsg-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.3-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.3-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:28.2+1-15+deb12u1"}]}],"versions":["1:28.2+1-15"]},{"source":"osv","ecosystem":"Debian:13","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.3+1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:29.3+1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"org-mode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.5.2+dfsh-5","9.6.10+dfsg-1","9.6.21+dfsg-1","9.6.23+dfsg-1","9.6.28+dfsg-1","9.6.6+dfsg-1~exp1","9.6.7+dfsg-1","9.6.8+dfsg-1","9.6.9+dfsg-1","9.7.11+dfsg-1","9.7.13+dfsg-1","9.7.15+dfsg-1","9.7.16+dfsg-1","9.7.19+dfsg-1","9.7.25+dfsg-1","9.7.27+dfsg-1","9.7.29+dfsg-1","9.7.34+dfsg-1","9.7.36+dfsg-1","9.7.5+dfsg-1","9.7.6+dfsg-1","9.7.6+dfsg-2","9.8.10+dfsg-1","9.8.12+dfsg-1","9.8.2+dfsg-1","9.8.3+dfsg-1","9.8.4+dfsg-1","9.8.6+dfsg-1","9.8.7+dfsg-1","9.8.9+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"org-mode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.23+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"org-mode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.23+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"emacs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.2-10.1.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"emacs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["24.5+1-1ubuntu2","24.5+1-1ubuntu4","24.5+1-1ubuntu5","24.5+1-1ubuntu6","24.5+1-1ubuntu7","24.5+1-6ubuntu1","24.5+1-6ubuntu1.1","24.5+1-6ubuntu1.1+esm1","24.5+1-6ubuntu1.1+esm2","24.5+1-6ubuntu1.1+esm3","24.5+1-6ubuntu1.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.22-4ubuntu3","21.4.22-14ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"emacs25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.2+1-6","25.2+1-6ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-4ubuntu1","21.4.24-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-8build1","21.4.24-9"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-4","2009.02.17.dfsg.2-5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-9ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.2-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"org-mode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.2+dfsh-4ubuntu0.1~esm1"}]}],"versions":["9.4.0+dfsg-1","9.5.2+dfsh-1","9.5.2+dfsh-2","9.5.2+dfsh-3","9.5.2+dfsh-4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12","21.4.24-12build2","21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-2","2009.02.17.dfsg.3-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"org-mode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10+dfsg-1ubuntu0.1~esm1"}]}],"versions":["9.6.7+dfsg-1","9.6.10+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xemacs21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.4.24-12build3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xemacs21-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2009.02.17.dfsg.3-3","2009.02.17.dfsg.3-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"org-mode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.3-2ubuntu0.1~esm1"}]}],"versions":["8.2.10-1","8.3.1-2","8.3.2-1","8.3.3-1","8.3.3-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"org-mode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.6+dfsg-1ubuntu0.1~esm1"}]}],"versions":["9.0.9+dfsg-3","9.1.2+dfsg-2","9.1.5+dfsg-1","9.1.6+dfsg-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"org-mode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.3.1+dfsg-1ubuntu0.1~esm1"}]}],"versions":["9.2.3+dfsg-1","9.3+dfsg-1","9.3+dfsg-2","9.3.1+dfsg-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"org-mode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.2+dfsh-4ubuntu0.1~esm1"}]}],"versions":["9.4.0+dfsg-1","9.5.2+dfsh-1","9.5.2+dfsh-2","9.5.2+dfsh-3","9.5.2+dfsh-4"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"org-mode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.6.10+dfsg-1ubuntu0.1~esm1"}]}],"versions":["9.6.7+dfsg-1","9.6.10+dfsg-1"],"bundled":4}],"products":[{"vendor":"gnu","product":"emacs"},{"vendor":"gnu","product":"org_mode"}],"references":[{"url":"https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=003ddacf1c8d869b1858181c29ea21b731a8d8d9","tags":["x_transferred","Patch","web","report"]},{"url":"https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29\u0026id=befa9fcaae29a6c9a283ba371c3c5234c7f644eb","tags":["x_transferred","Patch","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/25/2","tags":["mailing-list","x_transferred","Mailing List","article"]},{"url":"http://www.openwall.com/lists/oss-security/2024/04/08/6","tags":["mailing-list","x_transferred","Mailing List","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30202","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8r8f-v2fj-h7cp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30202.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-30202","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0104.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33019","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/03/24/1","tags":["web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/03/25/2","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-30202","tags":["report"]},{"url":"https://lists.gnu.org/archive/html/info-gnu/2024-03/msg00005.html","tags":["report"]},{"url":"https://list.orgmode.org/87o7b3eczr.fsf@bzg.fr/T/#t","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-30202","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7375-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-28617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-30205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-39331","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-30202","description":"In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.","status":"published","published":"2024-03-25T00:00:00Z","modified":"2024-11-13T17:54:10.866Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:07.831255Z"}],"euvd":[{"id":"EUVD-2024-28134","description":"In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.","status":"published","published":"2024-03-25T00:00:00Z","modified":"2024-11-13T17:54:10Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:05:02.084189Z"}],"ghsa":[{"id":"GHSA-8r8f-v2fj-h7cp","title":"In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This...","description":"In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.","status":"published","published":"2024-03-25T15:30:41Z","modified":"2024-11-14T21:31:57Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:58:50.242407Z"}],"nvd":[{"id":"CVE-2024-30202","description":"In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.","status":"published","published":"2024-03-25T15:15:52.427Z","modified":"2026-06-17T07:26:28.57Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:09:43.052376Z"}],"osv":[{"id":"CVE-2024-30202","description":"In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.","status":"published","published":"2024-03-25T00:00:00Z","modified":"2026-11-08T02:47:13.081395347Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-07T11:15:14.449016Z"},{"id":"DEBIAN-CVE-2024-30202","description":"In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.","status":"published","published":"2024-03-25T15:15:52.427Z","modified":"2026-11-02T12:02:16.302002667Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"UBUNTU-CVE-2024-30202","description":"In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.","status":"published","published":"2024-03-25T15:15:00Z","modified":"2026-10-17T12:56:44.68810435Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"AZL-37082","title":"CVE-2024-30202 affecting package emacs for versions less than 29.3-1","description":"In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.","status":"published","published":"2024-03-25T15:15:52Z","modified":"2026-04-21T04:28:10.155269Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"AZL-37105","title":"CVE-2024-30202 affecting package emacs for versions less than 29.3-1","description":"In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.","status":"published","published":"2024-03-25T15:15:52Z","modified":"2026-04-21T04:50:32.711421Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"MGASA-2024-0104","title":"Updated emacs packages fix security vulnerabilities","description":"In Emacs before 29.3, arbitrary Lisp code is evaluated as part of\nturning on Org mode. This affects Org Mode before 9.6.23.\n(CVE-2024-30202)\nIn Emacs before 29.3, Gnus treats inline MIME contents as trusted.\n(CVE-2024-30203)\nIn Emacs before 29.3, LaTeX preview is enabled by default for e-mail\nattachments. (CVE-2024-30204)\nIn Emacs before 29.3, Org mode considers contents of remote files to be\ntrusted. This affects Org Mode before 9.6.23. (CVE-2024-30205)\n","status":"published","published":"2024-03-31T03:27:58Z","modified":"2026-04-16T04:44:31.202880263Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"USN-7375-1","title":"org-mode vulnerabilities","description":"It was discovered that Org Mode did not correctly handle filenames\ncontaining shell metacharacters. An attacker could possibly use this issue\nto cause a denial of service or execute arbitrary code. This issue only\naffected Ubuntu 22.04 LTS. (CVE-2023-28617)\n\nIt was discovered that Org Mode could run untrusted code left in its\nbuffer. An attacker could possibly use this issue to cause a denial of\nservice or execute arbitrary code. This issue only affected\nUbuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-30202)\n\nIt was discovered that Org Mode did not correctly handle the contents of\nremote files. An attacker could possibly use this issue to cause a denial\nof service or execute arbitrary code. This issue only affected\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.\n(CVE-2024-30205)\n\nIt was discovered that Org Mode could be made to run arbitrary Elisp code.\nAn attacker could possibly use this issue to cause a denial of service or\nexecute arbitrary code. (CVE-2024-39331)\n","status":"published","published":"2025-03-27T00:41:50Z","modified":"2026-06-25T13:32:30.274844964Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}