CVE-2025-1244
HighCVSS 8.8Exploitation Probability (EPSS)
High risk84th percentile - higher than 84% of all known CVEs
Summary
A command injection vulnerability was discovered in the Emacs text editor. A remote, unauthenticated attacker can exploit it to execute arbitrary shell commands on a vulnerable system. The attack is triggered by tricking users into visiting a specially crafted website or an HTTP URL with a redirect.
Risk Assessment
The risk for the organization is the potential compromise of the user's system, which could lead to data theft, malware installation, or further attacks on the network infrastructure.
Recommendation
It is recommended to immediately update Emacs to the latest version containing the security fix. Until the update is applied, avoid opening untrusted HTTP links and using Emacs for web browsing.
Other vulnerabilities in Emacs
See all- CVE-2014-9483High
Emacs 24.4 allows remote attackers to bypass security restrictions.
- CVE-2000-0271Medium
The read-passwd and other Lisp functions in Emacs 20 do not properly clear the history of recently typed keys, allowing an attacker to read unencrypted passwords.
- CVE-2000-0269Low
Emacs 20 does not properly set permissions for a slave PTY device when starting a new subprocess, which allows local users to read or modify communications between Emacs and the subprocess.
- CVE-2000-0270Low
The make-temp-name function in Emacs 20 creates temporary files with predictable names, allowing attackers to conduct a symlink attack.
Original NVD description (English source)
A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect.