Org Mode · Org Mode · CVE-2024-39331
**Name of the Vulnerable Software and Affected Versions**
Emacs versions prior to 29.4
Org Mode versions prior to 9.7.5
**Description**
The issue arises from the expansion of a %(...) link abbrev by the org-link-expand-abbrev function in lisp/ol.el, even when it specifies an unsafe function like shell-command-to-string. This could allow a remote attacker to execute arbitrary code by injecting a specially crafted command.
**Recommendations**
For Emacs versions prior to 29.4, update to version 29.4 or later to resolve the issue.
For Org Mode versions prior to 9.7.5, update to version 9.7.5 or later to resolve the issue.
As a temporary workaround, consider disabling the `org-link-expand-abbrev` function until a patch is available.
Restrict access to the `shell-command-to-string` function to minimize the risk of exploitation.