CVE-2026-108976 in Emacs
Summary
by MITRE • 10/12/2026
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in GNU Emacs prior to version 31.2, specifically affecting the TRAMP component through version 2.8.2, represents a critical security flaw rooted in insufficient input validation mechanisms. This issue manifests as an operating system command injection vector that is triggered via filename handling within the remote file access protocol implementation. The core technical deficiency lies in the configuration variable tramp-user-regexp, which serves as a regular expression pattern intended to filter or validate user identifiers and associated path components during remote operations. Due to an incomplete list of disallowed inputs within this regex definition, certain maliciously crafted filenames can bypass existing sanitization checks. This oversight allows attackers to inject arbitrary shell commands that are subsequently executed by the underlying operating system with the privileges of the Emacs process, effectively compromising the integrity and confidentiality of the host environment.
This vulnerability is particularly significant because it represents a regression or an incomplete remediation effort related to CVE-2026-79992. Previous security updates attempted to address similar injection vectors but failed to cover all edge cases within the complex logic governing remote file transfers and directory listings in TRAMP. The persistence of this flaw indicates that the previous fix did not adequately account for variations in filename encoding, special character escaping, or specific parsing contexts where user-supplied data is concatenated into system commands without rigorous validation. Consequently, an attacker who can influence the filenames processed by Emacs during remote operations, such as when browsing directories on a remote server via TRAMP, may exploit this gap to achieve arbitrary code execution. The impact extends beyond simple local compromise; since TRAMP is often used for administrative tasks over SSH or other secure protocols, successful exploitation could lead to lateral movement within networked environments or the exfiltration of sensitive data stored in accessible directories.
From a classification perspective, this vulnerability aligns with CWE-78, which denotes Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The attack vector leverages the application's trust in user-supplied input within filename structures, failing to enforce strict allow-listing or robust escape sequences before passing data to system-level interpreters. In terms of tactical mapping under the MITRE ATT&CK framework, this flaw facilitates techniques associated with Execution via Remote Services and potentially Command and Control if used for persistent access. The incomplete nature of the previous fix highlights a common challenge in complex software ecosystems where partial patches may leave residual attack surfaces open to sophisticated adversaries who analyze patch diffs or test edge cases systematically.
Mitigation strategies must prioritize immediate upgrading to GNU Emacs version 31.2 or later, which includes the corrected implementation of tramp-user-regexp and other related validation logic within TRAMP 2.8.3 and beyond. For environments where an upgrade is not immediately feasible, administrators should enforce strict access controls on files that are processed by Emacs with elevated privileges and disable remote file editing capabilities if they are not strictly required for operational workflows. Additionally, implementing application whitelisting or sandboxing mechanisms can limit the blast radius of any potential command injection attempts. Security teams should also review logs for unusual subprocess creation events originating from Emacs processes, as these may indicate active exploitation attempts targeting this specific vulnerability pattern. Continuous monitoring and adherence to secure coding practices that emphasize input validation at all entry points are essential to preventing similar regressions in future updates.