CVE-2024-53920

CWE-94 — Code Injection9 documents8 sources
Severity
7.8HIGH
EPSS
0.0%
top 85.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
GNU Emacs
Timeline
PublishedNov 27
Latest updateFeb 4

Description

In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶NVDgnu/emacs< 30.1
▶Debianemacs< 1:27.1+1-3.1+deb11u6+3
▶Ubuntuemacs< 1:26.3+1-1ubuntu2+esm2+2

🔴Vulnerability Details

4
OSV
emacs vulnerabilities↗2026-02-04
▶
CVEList
CVE-2024-53920: In elisp-mode↗2024-11-27
▶
OSV
CVE-2024-53920: In elisp-mode↗2024-11-27
▶
GHSA
GHSA-8737-h7fg-9xgj: In elisp-mode↗2024-11-27
▶

📋Vendor Advisories

4
Ubuntu
Emacs vulnerabilities↗2026-02-04
▶
Red Hat
emacs: arbitrary code execution via Lisp macro expansion↗2024-11-27
▶
Microsoft
In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that↗2024-11-12
▶
Debian
CVE-2024-53920: emacs - In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-co...↗2024
▶
CVE-2024-53920 (HIGH CVSS 7.8) | In elisp-mode.el in GNU Emacs befor | cvebase.io