CVE-2023-28617 — OS Command Injection in ORG Mode

CWE-78 — OS Command InjectionCWE-77 — Command Injection12 documents8 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 80.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GNU EmacsGNU ORG Mode
Timeline
PublishedMar 19
Latest updateMar 27

Description

org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶Debiangnu/emacs< 1:27.1+1-3.1+deb11u6+3
▶NVDgnu/org_mode9.6.1

Patches

Patch: git.savannah.gnu.org ↗Patch: git.savannah.gnu.org ↗Patch: git.savannah.gnu.org ↗

🔴Vulnerability Details

4
OSV
org-mode vulnerabilities↗2025-03-27
▶
OSV
CVE-2023-28617: org-babel-execute:latex in ob-latex↗2023-03-19
▶
CVEList
CVE-2023-28617: org-babel-execute:latex in ob-latex↗2023-03-19
▶
GHSA
GHSA-xwfh-qqww-gr22: org-babel-execute:latex in ob-latex↗2023-03-19
▶

📋Vendor Advisories

7
Ubuntu
Org Mode vulnerabilities↗2025-03-27
▶
Ubuntu
Emacs vulnerabilities↗2024-09-19
▶
Red Hat
emacs: Regression of CVE-2023-28617 fixes in the Red Hat Enterprise Linux↗2023-05-09
▶
Ubuntu
Emacs vulnerability↗2023-04-06
▶
Red Hat
emacs: command injection vulnerability in org-mode↗2023-03-19
▶
CVE-2023-28617 — OS Command Injection in GNU ORG Mode | cvebase