CVE-2024-39331 is a critical vulnerability affecting GNU Emacs before version 29.4 and Org Mode before 9.7.5. It allows for arbitrary code execution due to improper handling of link abbreviations, where the org-link-expand-abbrev function can execute unsafe functions like shell-command-to-string. With a CVSS score of 9.8 (CRITICAL), this vulnerability is easily exploitable over the network with no user interaction, leading to complete compromise of confidentiality, integrity, and availability. While no public exploit code or active exploitation has been confirmed, the vulnerability has garnered some community discussion, indicating awareness within the cybersecurity community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 29.4CPE matchmatch criteria | cpe:2.3:a:gnu:emacs:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2024-39331
Sep 10, 2024emacs: org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code
Jun 23, 2024In Emacs before 29.4 org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function such as shell-command-to-string. This affects Org Mode before 9.7.5.
Jun 11, 2024