CVE-2024-30202

What it actually does

Arbitrary Lisp code is evaluated when Org mode is enabled in Emacs, leading to remote code execution.

Why it matters to the business

Attackers can gain code execution on developer or user systems by tricking users into opening malicious Org files, risking data theft or further compromise in environments relying on Emacs for editing.

How an attack unfolds

An attacker creates an Org file embedding Lisp code that runs automatically on mode activation and delivers it to a victim who opens the file in a vulnerable Emacs version.

How to fix it

Upgrade to Emacs 29.3 or Org-mode 9.6.23; apply commit 003ddacf1c8d869b1858181c29ea21b731a8d8d9 for the org-mode repository.

How to confirm the fix worked

Confirm Emacs version is 29.3 or later and Org-mode is 9.6.23 or later; test opening sample Org files without unintended code execution.

Typical attack path

1. Craft malicious Org file containing executable Lisp code
2. Deliver file via email, download, or shared repository
3. Victim opens file triggering Org mode activation
4. Embedded Lisp executes with user privileges

How to detect it

Review system and application logs for Emacs launching Org mode on unexpected files; inspect Org file headers and code blocks for suspicious Lisp expressions in forensic analysis.

What your security team should do

• Prioritize upgrade of Emacs and Org-mode across all systems
• Restrict opening of Org files from untrusted sources until patched
• Monitor EPSS and threat intelligence for any increase in exploitation activity