CVE-2024-30202: 
Emacs vulnerability analysis and mitigation

CVE-2024-30202 is a security vulnerability discovered in Emacs before version 29.3 and Org Mode before version 9.6.23, where arbitrary Lisp code could be evaluated as part of turning on Org mode. The vulnerability was disclosed on March 25, 2024, and affects both Emacs and Org Mode installations (NVD, OSS Security).

The vulnerability exists in the org-macro--set-templates function where arbitrary Lisp code could be evaluated during Org mode initialization. This could occur when a user opens a file or when mm-display-org-inline invokes Org mode to fontify MIME part preview in email messages. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access required with high impact potential (NVD). The issue has been classified as CWE-94: Improper Control of Generation of Code ('Code Injection').

The vulnerability could allow arbitrary code execution when a user opens an Org mode file or when previewing email messages with Org mode content. This could lead to unauthorized code execution in the context of the user running Emacs, potentially compromising the system's confidentiality, integrity, and availability (Emacs Commit).

The vulnerability can be exploited when a user opens a maliciously crafted Org mode file or when previewing malicious email content that triggers Org mode initialization. The attack vector requires local access and can be executed through email messages from potentially malicious senders (Org Mode Commit).

The vulnerability has been fixed in Emacs 29.3 and Org Mode 9.6.23. The fix prevents code evaluation during Org mode initialization by modifying the org-macro--set-templates function to avoid evaluating any code present inside the Org buffer while loading. Users are strongly advised to upgrade to these versions or later to protect against this vulnerability (OSS Security).