Vulnerability · Published Nov 27, 2024 · Assigned by mitre
CVE-2024-53920
High 7.8
In plain English
A high-severity code injection in the emacs package (AlmaLinux). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | emacs | 1:26.1-15.el8_10 | ALSA-2025:11030 |
| AlmaLinux:9 | emacs | 1:27.2-11.el9_5.2 | ALSA-2025:4787 |
| AlmaLinux:9 | emacs | 1:27.2-14.el9_6.2 | ALSA-2025:9448 |
| AlmaLinux:8 | emacs-common | 1:26.1-15.el8_10 | ALSA-2025:11030 |
| AlmaLinux:9 | emacs-common | 1:27.2-11.el9_5.2 | ALSA-2025:4787 |
| AlmaLinux:9 | emacs-common | 1:27.2-14.el9_6.2 | ALSA-2025:9448 |
| AlmaLinux:9 | emacs-filesystem | 1:27.2-14.el9_6.2 | ALSA-2025:9448 |
| AlmaLinux:9 | emacs-filesystem | 1:27.2-11.el9_5.2 | ALSA-2025:4787 |
| AlmaLinux:8 | emacs-lucid | 1:26.1-15.el8_10 | ALSA-2025:11030 |
| AlmaLinux:9 | emacs-lucid | 1:27.2-11.el9_5.2 | ALSA-2025:4787 |
| AlmaLinux:9 | emacs-lucid | 1:27.2-14.el9_6.2 | ALSA-2025:9448 |
| AlmaLinux:8 | emacs-nox | 1:26.1-15.el8_10 | ALSA-2025:11030 |
| AlmaLinux:9 | emacs-nox | 1:27.2-11.el9_5.2 | ALSA-2025:4787 |
| AlmaLinux:9 | emacs-nox | 1:27.2-14.el9_6.2 | ALSA-2025:9448 |
| AlmaLinux:8 | emacs-terminal | 1:26.1-15.el8_10 | ALSA-2025:11030 |
| Debian:12 | emacs | 1:28.2+1-15+deb12u4 | DEBIAN-CVE-2024-53920 |
| Debian:12 | emacs | 1:28.2+1-15+deb12u4 | DSA-5871-1 |
| Debian:13 | emacs | 1:30.1+1-1 | DEBIAN-CVE-2024-53920 |
| Debian:14 | emacs | 1:30.1+1-1 | DEBIAN-CVE-2024-53920 |
| Rocky Linux:8 | emacs | 1:26.1-15.el8_10 | RLSA-2025:11030 |
| Rocky Linux:9 | emacs | 1:27.2-11.el9_5.2 | RLSA-2025:4787 |
| Rocky Linux:9 | emacs | 1:27.2-14.el9_6.2 | RLSA-2025:9448 |
| Ubuntu:22.04:LTS | xemacs21 | no fix listed | UBUNTU-CVE-2024-53920 |
| Ubuntu:24.04:LTS | xemacs21 | no fix listed | UBUNTU-CVE-2024-53920 |
| Ubuntu:25.10 | xemacs21 | no fix listed | UBUNTU-CVE-2024-53920 |
| Ubuntu:26.04:LTS | xemacs21 | no fix listed | UBUNTU-CVE-2024-53920 |
| Ubuntu:26.10 | xemacs21 | no fix listed | UBUNTU-CVE-2024-53920 |
| Ubuntu:22.04:LTS | xemacs21-packages | no fix listed | UBUNTU-CVE-2024-53920 |
| Ubuntu:24.04:LTS | xemacs21-packages | no fix listed | UBUNTU-CVE-2024-53920 |
| Ubuntu:25.10 | xemacs21-packages | no fix listed | UBUNTU-CVE-2024-53920 |
| Ubuntu:26.04:LTS | xemacs21-packages | no fix listed | UBUNTU-CVE-2024-53920 |
| Ubuntu:26.10 | xemacs21-packages | no fix listed | UBUNTU-CVE-2024-53920 |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://git.savannah.gnu.org/cgit/emacs.git/tree/ChangeLog.4
- https://git.savannah.gnu.org/cgit/emacs.git/tag/?h=emacs-30.0.92
- https://eshelyaron.com/posts/2024-11-27-emacs-aritrary-code-execution-and-how-to-avoid-it.html
- https://yhetil.org/emacs/CAFXAjY5f4YfHAtZur1RAqH34UbYU56_t6t2Er0YEh1Sb7-W=hg@mail.gmail.com/
- https://news.ycombinator.com/item?id=42256409
- https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-30.1
- https://lists.debian.org/debian-lts-announce/2025/02/msg00033.html
- http://www.openwall.com/lists/oss-security/2026/08/20/3
- http://www.openwall.com/lists/oss-security/2026/08/20/7
- http://www.openwall.com/lists/oss-security/2026/09/14/1
- http://www.openwall.com/lists/oss-security/2026/09/21/9