CVE-2022-48339 is a command injection vulnerability in GNU Emacs through version 28.2, specifically within the htmlfontify.el component. It arises because the hfy-istext-command function fails to properly escape external input for file and source directory parameters, allowing shell metacharacters to execute arbitrary code. This vulnerability carries a high severity CVSS score of 7.8, indicating a local attack vector with low complexity, potentially leading to high impact on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 28.2CPE matchmatch criteria | cpe:2.3:a:gnu:emacs:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2022-48339
Mar 14, 2023emacs: command injection vulnerability in htmlfontify.el
Feb 21, 2023An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function the parameter file and parameter srcdir come from external input and parameters are not escaped. If a file name or directory name contains shell metacharacters code may be executed.
Feb 14, 2023