CVE-2024-39331: Code Injection
GNU Emacs could allow a remote attacker to execute arbitrary code on the system, caused by a code injection flaw in org-link-expand-abbrev in lisp/ol.el. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Other sources
In Emacs before 29.4 org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function such as shell-command-to-string. This affects Org Mode before 9.7.5.
— Microsoft
In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39331?
CVE-2024-39331 is considered a security vulnerability due to unsafe function execution in Emacs' org-link-expand-abbrev.
How do I fix CVE-2024-39331?
To fix CVE-2024-39331, upgrade Emacs to version 29.4 or Org Mode to version 9.7.5 or later.
Which versions of Emacs are affected by CVE-2024-39331?
Emacs versions prior to 29.4 are affected by CVE-2024-39331.
Which versions of Org Mode need to be updated to address CVE-2024-39331?
Org Mode versions before 9.7.5 are affected and should be updated to this version or later.
What does CVE-2024-39331 exploit in Emacs?
CVE-2024-39331 exploits the ability to expand unsafe function links in the org-link-expand-abbrev feature of Emacs.