CVE-2025-1244
High
Description
A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Emacs
PublishedFeb 12, 2025
First seenFeb 12, 2025
Weakness typeCWE-78OS command injection
How to fix
Update
- emacs29.4.0 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2025:1915
- access.redhat.com/errata/RHSA-2025:1917
- access.redhat.com/errata/RHSA-2025:1961
- access.redhat.com/errata/RHSA-2025:1962
- access.redhat.com/errata/RHSA-2025:1963
- access.redhat.com/errata/RHSA-2025:1964
- access.redhat.com/errata/RHSA-2025:2022
- access.redhat.com/errata/RHSA-2025:2130
- access.redhat.com/errata/RHSA-2025:2157
- access.redhat.com/errata/RHSA-2025:2195
- access.redhat.com/errata/RHSA-2025:2754
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| emacs | v < 29.4.0 | 29.4.0 |
| Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support | No range specified | — |
| enterprise_linux 8 | No range specified | — |
| rhel_aus 8.2 | No range specified | — |
| rhel_aus 8.4 | No range specified | — |
| rhel_aus 8.6 | No range specified | — |
| rhel_eus 8.8 | No range specified | — |
| enterprise_linux 9 | No range specified | — |
| rhel_e4s 9.0 | No range specified | — |
| rhel_eus 9.2 | No range specified | — |
| rhel_eus 9.4 | No range specified | — |
| openshift_builds 1.3 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.