CVE-2024-53920
published 2024-11-27CVE-2024-53920: In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can…
PriorityP340high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.60%
48.0th percentile
In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | emacs | < emacs 1:28.2+1-15+deb12u4 (bookworm) | emacs 1:28.2+1-15+deb12u4 (bookworm) |
| gnu | emacs | < 30.1 | 30.1 |
| gnu | emacs | — | — |
| gnu | emacs | >= 0 < 1:27.1+1-3.1+deb11u6 | 1:27.1+1-3.1+deb11u6 |
| gnu | emacs | >= 0 < 1:28.2+1-15+deb12u4 | 1:28.2+1-15+deb12u4 |
| gnu | emacs | >= 0 < 1:30.1+1-1 | 1:30.1+1-1 |
| gnu | emacs | >= 0 < 1:30.1+1-1 | 1:30.1+1-1 |
| gnu | emacs | >= 0 < 1:26.3+1-1ubuntu2+esm2 | 1:26.3+1-1ubuntu2+esm2 |
| gnu | emacs | >= 0 < 1:27.1+1-3ubuntu5.2+esm1 | 1:27.1+1-3ubuntu5.2+esm1 |
| gnu | emacs | >= 0 < 1:29.3+1-1ubuntu2+esm3 | 1:29.3+1-1ubuntu2+esm3 |
| msrc | azl3_emacs_29.4-3_on_azure_linux_3.0 | — | — |
| msrc | cbl2_emacs_29.4-3_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
emacs: Emacs: arbitrary code execution, incomplete fix for CVE-2024-53920
vendor_redhat·2026-09-14·CVSS 7.8
CVE-2026-96442 [HIGH] CWE-94 emacs: Emacs: arbitrary code execution, incomplete fix for CVE-2024-53920
emacs: Emacs: arbitrary code execution, incomplete fix for CVE-2024-53920
A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs.
Package: emacs (Red Hat Enterprise Linux 10) - Affected
Package: emacs (Red Hat Enterprise Linux 6) - Out of support scope
Package: emacs (Red Hat Enterprise Linux 7) - Affected
Package: emacs (Red Hat Enterprise Linux 8) - Affected
Package: emacs (Red Hat Enterprise Linux 9) - Affected
Ubuntu
Emacs vulnerabilities
vendor_ubuntu·2026-02-04·CVSS 7.8
CVE-2025-1244 [HIGH] Emacs vulnerabilities
Title: Emacs vulnerabilities
Summary: Several security issues were fixed in Emacs.
It was discovered that Emacs could trigger unsafe Lisp macro expansion,
when a user invoked elisp-completion-at-point on untrusted Emacs Lisp
source code. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2024-53920)
It was discovered that Emacs did not properly sanitize input when
handling certain URI schemes. An attacker could possibly use this issue
to execute arbitrary shell commands by tricking a user into opening a
specially crafted URL. (CVE-2025-1244)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
emacs: arbitrary code execution via Lisp macro expansion
vendor_redhat·2024-11-27·CVSS 7.8
CVE-2024-53920 [HIGH] CWE-94 emacs: arbitrary code execution via Lisp macro expansion
emacs: arbitrary code execution via Lisp macro expansion
In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)
A flaw was found in Emacs. Viewing or editing an untrusted Emacs Lisp source code file can cause arbitrary code execution due to unsafe macro expansion when a user has configured elisp-completion-at-point for code completion or has enabled automatic error checking, such as Flymake or Flycheck.
Statement: To exploit this flaw, an attacker needs to trick a
Microsoft
In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that
vendor_msrc·2024-11-12·CVSS 7.8
CVE-2024-53920 [HIGH] CWE-94 In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that
In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparen
Debian
CVE-2024-53920: emacs - In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-co...
vendor_debian·2024·CVSS 7.8
CVE-2024-53920 [HIGH] CVE-2024-53920: emacs - In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-co...
In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)
Scope: local
bookworm: resolved (fixed in 1:28.2+1-15+deb12u4)
bullseye: resolved (fixed in 1:27.1+1-3.1+deb11u6)
forky: resolved (fixed in 1:30.1+1-1)
sid: resolved (fixed in 1:30.1+1-1)
trixie: resolved (fixed in 1:30.1+1-1)
VulDB
GNU Emacs up to 30.0.92 elisp-mode.el code injection (EUVD-2024-52189 / Nessus ID 213301)
vuldb·2026-08-22·CVSS 7.8
CVE-2024-53920 [HIGH] GNU Emacs up to 30.0.92 elisp-mode.el code injection (EUVD-2024-52189 / Nessus ID 213301)
A vulnerability, which was classified as critical, has been found in GNU Emacs up to 30.0.92. The affected element is an unknown function of the file elisp-mode.el. The manipulation leads to code injection.
This vulnerability is traded as CVE-2024-53920. Access to the local network is required for this attack to succeed. There is no exploit available.
OSV
emacs vulnerabilities
osv·2026-02-04·CVSS 7.8
CVE-2024-53920 [HIGH] emacs vulnerabilities
emacs vulnerabilities
It was discovered that Emacs could trigger unsafe Lisp macro expansion,
when a user invoked elisp-completion-at-point on untrusted Emacs Lisp
source code. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2024-53920)
It was discovered that Emacs did not properly sanitize input when
handling certain URI schemes. An attacker could possibly use this issue
to execute arbitrary shell commands by tricking a user into opening a
specially crafted URL. (CVE-2025-1244)
OSV
CVE-2024-53920: In elisp-mode
osv·2024-11-27·CVSS 7.8
CVE-2024-53920 [HIGH] CVE-2024-53920: In elisp-mode
In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)
GHSA
GHSA-8737-h7fg-9xgj: In elisp-mode
ghsa_unreviewed·2024-11-27
CVE-2024-53920 [CRITICAL] CWE-94 GHSA-8737-h7fg-9xgj: In elisp-mode
In elisp-mode.el in GNU Emacs through 30.0.92, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)
No detection rules found.
No public exploits indexed.
Bugzilla
emacs: Emacs: arbitrary code execution, incomplete fix for CVE-2024-53920 [fedora-all]
bugzilla·2026-09-21·CVSS 7.8
CVE-2024-53920 [HIGH] emacs: Emacs: arbitrary code execution, incomplete fix for CVE-2024-53920 [fedora-all]
emacs: Emacs: arbitrary code execution, incomplete fix for CVE-2024-53920 [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Emacs upstream reports:
Bas Alberts of the GitHub Security Lab discovered that the fix for
CVE-2024-53920, an arbitrary code execution flaw in Emacs, was
incomplete. Viewing or editing untrusted text files in modes other than
Emacs Lisp mode can also permit arbitrary code execution. For example:
#!/usr/bin/perl
# -*- mode: perl; mode: flymake -*-
BEGIN { system("touch uh_oh.txt"); }
This problem affects all Emacs versions affected by CVE-2024-53920.
This means Emacs 24 and newer,
Bugzilla
emacs: Emacs: arbitrary code execution, incomplete fix for CVE-2024-53920
bugzilla·2026-09-21·CVSS 7.8
CVE-2024-53920 [HIGH] emacs: Emacs: arbitrary code execution, incomplete fix for CVE-2024-53920
emacs: Emacs: arbitrary code execution, incomplete fix for CVE-2024-53920
Emacs upstream reports:
Bas Alberts of the GitHub Security Lab discovered that the fix for
CVE-2024-53920, an arbitrary code execution flaw in Emacs, was
incomplete. Viewing or editing untrusted text files in modes other than
Emacs Lisp mode can also permit arbitrary code execution. For example:
#!/usr/bin/perl
# -*- mode: perl; mode: flymake -*-
BEGIN { system("touch uh_oh.txt"); }
This problem affects all Emacs versions affected by CVE-2024-53920.
This means Emacs 24 and newer, and possibly also older versions.
A minimal fix, attached, is queued up for release with Emacs 31.2.
We (the Emacs upstream maintainers) don't expect to backport the fix to
older Emacs releases ourselves.
Source:
https://www.openwall.c
Bugzilla
CVE-2024-53920 emacs: arbitrary code execution via Lisp macro expansion
bugzilla·2024-11-27·CVSS 7.8
CVE-2024-53920 [HIGH] CVE-2024-53920 emacs: arbitrary code execution via Lisp macro expansion
CVE-2024-53920 emacs: arbitrary code execution via Lisp macro expansion
In elisp-mode.el in GNU Emacs through 30.0.92, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)
Discussion:
There is an upstream fix addressing this CVE: https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=b5158bd191422e46273c4d9412f2bf097e2da2e0
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:4787 https://access.redhat.com/errata/RHSA-2025:4787
---
This issue has been
https://eshelyaron.com/posts/2024-11-27-emacs-aritrary-code-execution-and-how-to-avoid-it.htmlhttps://git.savannah.gnu.org/cgit/emacs.git/tag/?h=emacs-30.0.92https://git.savannah.gnu.org/cgit/emacs.git/tree/ChangeLog.4https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-30.1https://news.ycombinator.com/item?id=42256409https://yhetil.org/emacs/CAFXAjY5f4YfHAtZur1RAqH34UbYU56_t6t2Er0YEh1Sb7-W=hg@mail.gmail.com/http://www.openwall.com/lists/oss-security/2026/08/20/3http://www.openwall.com/lists/oss-security/2026/08/20/7http://www.openwall.com/lists/oss-security/2026/09/14/1http://www.openwall.com/lists/oss-security/2026/09/21/9https://lists.debian.org/debian-lts-announce/2025/02/msg00033.html
2024-11-27
Published