CVE-2026-108976
published 2026-10-11CVE-2026-108976: GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed…
PriorityP347high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.51%
42.2th percentile
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | emacs | < 31.2 | 31.2 |
| gnu | emacs | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
emacs: zero-click local command execution via TRAMP
vendor_redhat·2026-10-11·CVSS 7.8
CVE-2026-108976 [HIGH] CWE-184 emacs: zero-click local command execution via TRAMP
emacs: zero-click local command execution via TRAMP
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.
A flaw was found in Emacs. Processing a specially crafted filename with TRAMP can cause an OS command execution because tramp-user-regexp has an incomplete list of disallowed inputs. This vulnerability exists due to an incomplete fix of CVE-2026-79992.
Statement: To exploit this issue, a user needs to open or process a specially crafted filename using the TRAMP package, limiting the possibility of exploitation. However, as this issue allows OS command execution, it has been rated with an important severit
VulDB
GNU Emacs up to 31.1 TRAMP tramp-user-regexp os command injection
vuldb·2026-10-11·CVSS 7.8
CVE-2026-108976 [HIGH] GNU Emacs up to 31.1 TRAMP tramp-user-regexp os command injection
A vulnerability classified as problematic was found in GNU Emacs up to 31.1. This issue affects the function tramp-user-regexp of the component TRAMP. Executing a manipulation can lead to os command injection.
The identification of this vulnerability is CVE-2026-108976. The attack can only be executed locally. There is no exploit available.
Upgrading the affected component is advised.
GHSA
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs.
ghsa_unreviewed·2026-10-11·CVSS 7.8
CVE-2026-108976 [HIGH] CWE-184 GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs.
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-108976 emacs: zero-click local command execution via TRAMP [fedora-all]
bugzilla·2026-10-13·CVSS 7.8
CVE-2026-108976 [HIGH] CVE-2026-108976 emacs: zero-click local command execution via TRAMP [fedora-all]
CVE-2026-108976 emacs: zero-click local command execution via TRAMP [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.
Bugzilla
CVE-2026-108976 emacs: zero-click local command execution via TRAMP
bugzilla·2026-10-11·CVSS 7.8
CVE-2026-108976 [HIGH] CVE-2026-108976 emacs: zero-click local command execution via TRAMP
CVE-2026-108976 emacs: zero-click local command execution via TRAMP
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.
Rapid7
Patch Tuesday - October 2026
blogs_rapid7·2026-10-13·CVSS 8.8
CVE-2026-96951 [HIGH] Patch Tuesday - October 2026
Microsoft is publishing 1,413 own-product vulnerabilities on October 2026 Patch Tuesday , including 1,102 vulnerabilities in Windows. Anyone who enjoyed last month’s record-setting Patch Tuesday will love the October 2026 edition, because it’s much bigger still. As Rapid7 has noted over the course of 2026, there is every reason to suppose that vulnerability volumes will continue to rise. Microsoft is aware of exploitation in the wild for just one of the vulnerabilities published today, as well as public disclosure for two others.
## Windows Shell: zero-day security feature bypass
The Windows Shell is Microsoft’s term for the GUI interaction logic for the entire OS provided by explorer.exe and associated libraries and APIs, and for the second time this year , the Windows Shell is the site
2026-10-11
Published