Threat Investigation
Request a demo

CVE-2024-53920

High

Description

In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)

SeverityHigh
CVSS7.8
Exploit probability—
ProductGnu Emacs
PublishedNov 27, 2024
First seenNov 27, 2024
Weakness typeCWE-94Code injection

How to fix

Update
  • gnu emacs30.1 or later

Affected products

ProductAffected versionsFixed in
gnu emacsv < 30.130.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.