CVE-2026-108976
Fixed in a distro release EPSS <1%CVSS 7.8
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.
Products: gnu emacs
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | emacs | 27.2-150400.3.37.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | emacs | 27.2-150400.3.37.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | emacs | 27.2-150400.3.37.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | emacs | 27.2-150400.3.37.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | emacs | 27.2-150400.3.37.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP7 | emacs | 27.2-150400.3.37.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | emacs | 27.2-150400.3.37.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | emacs | 27.2-150400.3.37.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | emacs | 27.2-150400.3.37.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | emacs | 27.2-150400.3.37.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | emacs | 27.2-150400.3.37.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | emacs | 27.2-150400.3.37.1 |
| Ubuntu 16.04 LTS | xemacs21 | no fix |
| Ubuntu 16.04 LTS | xemacs21-packages | no fix |
| Ubuntu 18.04 LTS | xemacs21 | no fix |
| Ubuntu 18.04 LTS | xemacs21-packages | no fix |
| Ubuntu 20.04 LTS | xemacs21 | no fix |
| Ubuntu 20.04 LTS | xemacs21-packages | no fix |
| Ubuntu 22.04 LTS | xemacs21 | no fix |
| Ubuntu 22.04 LTS | xemacs21-packages | no fix |
| Ubuntu 24.04 LTS | xemacs21 | no fix |
| Ubuntu 24.04 LTS | xemacs21-packages | no fix |
| Ubuntu 26.04 LTS | xemacs21 | no fix |
| Ubuntu 26.04 LTS | xemacs21-packages | no fix |
| Ubuntu 26.10 | emacs | no fix |
| Ubuntu 26.10 | xemacs21 | no fix |
| Ubuntu 26.10 | xemacs21-packages | no fix |
| Ubuntu Pro 16.04 LTS | emacs24 | no fix |
| Ubuntu Pro 18.04 LTS | emacs25 | no fix |
| Ubuntu Pro 20.04 LTS | emacs | no fix |
| Ubuntu Pro 22.04 LTS | emacs | no fix |
| Ubuntu Pro 24.04 LTS | emacs | no fix |
| Ubuntu Pro 26.04 LTS | emacs | no fix |