PT-2023-9293 · Gnu Emacs+7 · Gnu Emacs+7
Xi Lu
·
Published
2023-02-20
·
Updated
2025-03-18
·
CVE-2022-48338
CVSS v3.1
7.3
High
| Vector | AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
GNU Emacs versions through 28.2
Description
An issue was discovered in GNU Emacs where the
ruby-find-library-file function in ruby-mode.el has a local command injection vulnerability. The ruby-find-library-file function is an interactive function bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped, allowing malicious Ruby source files to cause commands to be executed.Recommendations
For GNU Emacs versions through 28.2, as a temporary workaround, consider disabling the
ruby-find-library-file function until a patch is available. Restrict access to the ruby-mode.el module to minimize the risk of exploitation. Avoid using the feature-name parameters in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Gnu Emacs
Linuxmint
Red Hat
Red Os
Suse
Ubuntu