CVE-2026-108976: 
Emacs vulnerability analysis and mitigation

CVE-2026-108976 is an OS command injection vulnerability in GNU Emacs (before version 31.2) and TRAMP (through version 2.8.2) that allows a local attacker to execute arbitrary OS commands via a specially crafted filename. The flaw exists because tramp-user-regexp contains an incomplete list of disallowed inputs, representing an incomplete fix for the earlier CVE-2026-79992. It was disclosed on October 11, 2026, following discovery by Wonyoung Jung of 78ResearchLab using the PatchHawk tool. It carries a CVSS v3.1 base score of 7.8 (High) (Github Advisory, oss-security).

The root cause is classified as CWE-184 (Incomplete List of Disallowed Inputs). The tramp-user-regexp in tramp.el failed to exclude several shell-significant characters (e.g., !, #, &, ,, and control characters) from valid usernames, allowing injection of OS commands through a maliciously crafted filename parsed by TRAMP's file-name handler. When Emacs processes such a filename — for example, via file-exists-p or directory traversal — TRAMP builds a login command by expanding arguments including the user field and passes it unquoted to a local shell (tramp-encoding-shell, typically /bin/sh), executing the injected payload before any actual remote connection is established. The patch by TRAMP maintainer Michael Albinus updates tramp-user-regexp to additionally exclude !, #, &, ,, and control characters, and adds validation for environment variable patterns in user and host names (oss-security, oss-security Aug).

Successful exploitation allows a local user with Emacs access to execute arbitrary OS commands with the privileges of the Emacs process, resulting in high confidentiality, integrity, and availability impact. An attacker can achieve full compromise of the local user's environment, including reading sensitive files, modifying data, or disrupting availability. Because the payload executes during file-name processing (e.g., directory scans or stat calls), exploitation can occur without explicit user interaction beyond opening or scanning a directory containing a malicious filename or symlink (Github Advisory, oss-security Aug).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment indicates exploitation is currently "none" and the attack is not automatable. The EPSS score is approximately 0.505%, placing it in the 42nd percentile for exploitation likelihood within 30 days. No threat actor attribution has been reported (Github Advisory).

1. Craft a malicious filename: Create a filename or symlink target containing a TRAMP-style path with an injected shell payload in the user field, e.g., /ssh:user!$(touch$IFS/tmp/pwned)@127.0.0.1:/x, exploiting characters (such as !, #, &) that were not blocked by the original tramp-user-regexp.
2. Place the artifact on the filesystem: Store the malicious symlink or directory structure in a location likely to be scanned by the victim's Emacs session, such as a shared directory, a git repository, or a project folder. Symlink targets can contain arbitrary bytes (except NUL), making them suitable carriers.
3. Trigger Emacs file processing: Wait for or induce the victim to open, stat, or recursively scan the directory in Emacs (e.g., via dired, find-file, directory-files-recursively, or any plugin that traverses directories). Emacs with TRAMP loaded will dispatch the filename to TRAMP's handler.
4. Payload execution: TRAMP's tramp-dissect-file-name parses the embedded TRAMP path, extracts the injected user field, and passes it unquoted to the local shell during connection setup — executing the attacker's payload with the privileges of the Emacs process before any SSH connection is attempted (oss-security Aug, oss-security).

• File System: Unexpected files created in world-writable directories (e.g., /tmp/pwned) as a result of injected commands; malicious symlinks with TRAMP-style targets (e.g., /ssh:payload@host:/x) in shared or scanned directories; new files or scripts dropped by the Emacs process user account.
• Process: Unusual child processes spawned by the Emacs process (e.g., /bin/sh, bash, curl, wget, python) during file browsing or directory scanning operations.
• Logs: System audit logs (auditd) showing unexpected execve calls originating from the Emacs process; shell history entries referencing TRAMP-style filenames with special characters in the user field.
• Network: Unexpected outbound connections from the Emacs process to external hosts, particularly if the injected payload includes a reverse shell or data exfiltration command (oss-security Aug).

Upgrade GNU Emacs to version 31.2 or later, and update TRAMP to version 2.8.3 or later, which include the corrected tramp-user-regexp that blocks additional shell-significant characters (oss-security, Github Advisory). Users unable to upgrade immediately should avoid opening, scanning, or browsing directories with untrusted content in Emacs, particularly directories containing filenames or symlinks with special characters that could be interpreted as shell metacharacters. Red Hat has tracked this issue in Bugzilla (Bug 2549383) and users of RHEL-based systems should monitor for distribution-specific package updates (bugzilla.redhat.com).

The vulnerability was reported to the oss-security mailing list by Sean Whitton on October 11, 2026, crediting Wonyoung Jung of 78ResearchLab for discovering the incomplete fix using the PatchHawk tool, and TRAMP maintainer Michael Albinus for preparing the patch (oss-security). The original underlying vulnerability (CVE-2026-79992) was discovered by Bas Alberts of the GitHub Security Lab and described as a "zero-click local command execution" issue, generating notable attention in the open-source security community (oss-security Aug). Coverage appeared on Linux Security news outlets and vulnerability aggregators shortly after disclosure (linuxsecurity.com).