PT-2024-4296 · Org Mode+12 · Org Mode+12
Ihor Radchenko
·
Published
2024-06-23
·
Updated
2026-06-08
·
CVE-2024-39331
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Emacs versions prior to 29.4
Org Mode versions prior to 9.7.5
Description
The issue arises from the expansion of a %(...) link abbrev by the org-link-expand-abbrev function in lisp/ol.el, even when it specifies an unsafe function like shell-command-to-string. This could allow a remote attacker to execute arbitrary code by injecting a specially crafted command.
Recommendations
For Emacs versions prior to 29.4, update to version 29.4 or later to resolve the issue.
For Org Mode versions prior to 9.7.5, update to version 9.7.5 or later to resolve the issue.
As a temporary workaround, consider disabling the
org-link-expand-abbrev function until a patch is available.
Restrict access to the shell-command-to-string function to minimize the risk of exploitation.Fix
Code Injection
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Emacs
Linuxmint
Org Mode
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu