high7.8
CVE-2026-108976
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed input…
Impact
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.
Affected products
| Product | Affected versions |
|---|---|
| GNU Emacs | before 31.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.