CVE-2026-108976

Published: Oct 11, 2026Modified: Oct 16, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: MITRE (Secondary)

Description

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

Related CWEs

CWE-184

Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.

References (3)

https://ftp.gnu.org/gnu/tramp/tramp-2.8.2.tar.gz

Source: cve@mitre.org

https://www.openwall.com/lists/oss-security/2026/08/21/1

Source: cve@mitre.org

https://www.openwall.com/lists/oss-security/2026/10/11/1

Source: cve@mitre.org

Timeline

No history available yet.