GNU Emacs up to 28.2 htmlfontify.el hfy-istext-command file/srcdir os command injection

Summaryinfo

A vulnerability classified as critical has been found in GNU Emacs up to 28.2. The affected element is the function hfy-istext-command of the file htmlfontify.el. Performing a manipulation of the argument file/srcdir results in os command injection. This vulnerability is known as CVE-2022-48339. Remote exploitation of the attack is possible. No exploit is available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability classified as critical has been found in GNU Emacs up to 28.2 (Word Processing Software). This affects the function hfy-istext-command of the file htmlfontify.el. The manipulation of the argument file/srcdir with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.

The weakness was published 02/21/2023. It is possible to read the advisory at git.savannah.gnu.org. This vulnerability is uniquely identified as CVE-2022-48339 since 02/20/2023. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 242832 (NewStart CGSL MAIN 7.02 : emacs Multiple Vulnerabilities (NS-SA-2025-0115)), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.savannah.gnu.org.

The vulnerability is also documented in the vulnerability database at Tenable (242832). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Word Processing Software

Vendor

• GNU

Name

• Emacs

Version

• 28.0
• 28.1
• 28.2

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion