CVE-2026-108976: 
Emacs Análisis y mitigación de vulnerabilidades

CVE-2026-108976 is an OS command injection vulnerability in GNU Emacs (before version 31.2) and TRAMP (through version 2.8.2) that allows a local attacker to execute arbitrary OS commands via a specially crafted filename. The flaw exists because tramp-user-regexp contains an incomplete list of disallowed inputs, and represents an incomplete fix for the earlier CVE-2026-79992. It was disclosed on October 11, 2026, following discovery by Wonyoung Jung of 78ResearchLab using the PatchHawk tool. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Github Advisory, oss-security).

The root cause is classified as CWE-184 (Incomplete List of Disallowed Inputs). The original fix for CVE-2026-79992 updated tramp-user-regexp in tramp.el to block certain shell metacharacters in TRAMP filenames, but failed to exclude additional dangerous characters such as !, #, &, ,, and control characters. As a result, an attacker can craft a filename containing shell metacharacters (e.g., $(), backticks, or $IFS substitutions) that are passed unquoted to a local shell spawned by TRAMP during connection setup — executing commands before any actual remote connection is established. The patch by TRAMP maintainer Michael Albinus expands the blocklist in tramp-user-regexp and adds validation for both user and host name fields (oss-security, oss-security Aug).

Successful exploitation allows a local user with Emacs access to execute arbitrary OS commands with the privileges of the Emacs process, resulting in high confidentiality, integrity, and availability impact. An attacker can read sensitive files, modify data, or disrupt system availability without requiring user interaction beyond the victim opening or stat-ing a maliciously named file. In environments where Emacs runs with elevated privileges or is used by multiple users, the risk of privilege escalation or lateral movement is significant (Github Advisory, oss-security Aug).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires local access and low privileges, but no user interaction, making it a realistic threat in multi-user environments where untrusted filenames may be encountered.

1. Craft a malicious filename: Create a file or symlink whose name embeds shell metacharacters not blocked by the original tramp-user-regexp, such as !, #, &, or control characters, combined with command substitution syntax (e.g., /ssh:$(touch$IFS/tmp/pwned)@127.0.0.1:/x).
2. Trigger TRAMP processing: Cause the victim's Emacs instance to process the malicious filename — this can occur via file-exists-p, directory-files-recursively, or simply opening a directory containing the crafted file or symlink.
3. Exploit incomplete input validation: TRAMP's tramp-dissect-file-name parses the embedded TRAMP-style path and passes the user field (containing the payload) unquoted to the local shell (tramp-encoding-shell, typically /bin/sh) during connection setup.
4. Achieve command execution: The injected shell command executes in the local shell with the privileges of the Emacs process, before any actual SSH connection is attempted — enabling arbitrary command execution, file creation, data exfiltration, or further system compromise (oss-security Aug, oss-security).

• File System: Unexpected files created in world-writable directories (e.g., /tmp/pwned) as a result of command injection payloads; symlinks with TRAMP-style names containing shell metacharacters (e.g., /ssh:$(...)@host:/x).
• Process: Unusual child processes spawned by the Emacs process (e.g., /bin/sh, bash, curl, wget, python) with suspicious arguments or no associated user interaction.
• Logs: System logs (e.g., auth.log, syslog) showing unexpected command execution originating from the Emacs process user; audit logs recording file creation or network connections initiated by Emacs.
• Network: Unexpected outbound connections from the Emacs process to external hosts, particularly if TRAMP is not normally used for remote file access in the environment.

Upgrade GNU Emacs to version 31.2 or later, which includes the corrected tramp-user-regexp and additional validation logic for user and host name fields. For TRAMP used as a standalone package, upgrade to version 2.8.3 or later. Users unable to upgrade immediately should avoid opening files with untrusted or suspicious filenames in Emacs, particularly those containing shell metacharacters, and should restrict access to directories that may contain attacker-controlled filenames (Github Advisory, oss-security).

The vulnerability was reported to the oss-security mailing list by Sean Whitton on October 11, 2026, crediting Wonyoung Jung of 78ResearchLab and their PatchHawk tool for discovering the incomplete fix. TRAMP maintainer Michael Albinus prepared the patch. The original underlying vulnerability (CVE-2026-79992) was disclosed by Bas Alberts of the GitHub Security Lab in August 2026, and the community noted the severity of the "zero-click" local command execution primitive enabled by TRAMP's filename handling (oss-security, oss-security Aug).