PT-2023-21850 · Gnu Emacs+10 · Gnu Emacs+10

Lux + 1 · Published 2023-03-18 · Updated 2025-08-14 · CVE-2023-28617

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Org Mode versions through 9.6.1

Description The issue allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters. This is possible due to a flaw in the org-babel-execute:latex function in ob-latex.el for GNU Emacs.

Recommendations For versions through 9.6.1, consider disabling the org-babel-execute:latex function until a patch is available to prevent the execution of arbitrary commands. Restrict access to file names and directory names that may contain shell metacharacters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

ALSA-2023:1930

ALSA-2023:2074

ALSA-2023:2626

ALSA-2023:3104

AZL-25707

BDU:2025-11741

CESA-2023_1930

CVE-2023-28617

DLA-3416-1

DLA-3616-1

DLA-4069-1

MGASA-2023-0152

OESA-2023-1185

RHSA-2023:1915

RHSA-2023:1930

RHSA-2023:1931

RHSA-2023:1958

RHSA-2023:2010

RHSA-2023:2074

RHSA-2023:3189

RHSA-2023_1930

RHSA-2023_2074

RLSA-2023:1930

RLSA-2023:2074

USN-6003-1

USN-7027-1

USN-7375-1

Affected Products

Almalinux

Astra Linux

Centos

Debian

Gnu Emacs

Linuxmint

Org Mode

Red Hat

Red Os

Rocky Linux

Ubuntu

References · 76

• https://ubuntu.com/security/notices/USN-6003-1 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2023-1930.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:3104 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3616-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28617 · Security Note
• https://ubuntu.com/security/CVE-2022-48339 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-2074.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48338 · Vendor Advisory
• https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=8f8ec2ccf3f5ef8f38d68ec84a7e4739c45db485 · Patch
• https://osv.dev/vulnerability/RLSA-2023:2074 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2023:2074 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3416-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48337 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6003-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-2074.html · Vendor Advisory