CVE-2024-39331

What it actually does

The vulnerability allows org-link-expand-abbrev to invoke arbitrary unsafe Elisp functions (such as shell-command-to-string) when expanding %(...) link abbreviations, bypassing intended safety checks and enabling remote command execution.

Why it matters to the business

Attackers can run arbitrary commands on systems processing Org documents, leading to full system compromise, data theft, or ransomware deployment with minimal attacker effort and no user interaction required.

How an attack unfolds

An attacker crafts a malicious Org-mode link containing a %(...) abbreviation that references an unsafe function. When the victim opens or exports the document in vulnerable Emacs/Org-mode, the link expansion executes the function, resulting in command injection. The flaw affects any downstream consumers of Org files or Emacs configurations.

How to fix it

Upgrade Emacs to 29.4 or later and Org Mode to 9.7.5 or later. For Debian 11 apply emacs 1:27.1+1-3.1+deb11u5 and org-mode 9.4.0+dfsg-1+deb11u3; for Debian 12 apply emacs 1:28.2+1-15+deb12u3. For ossrs/srs apply commit 244ce7bc013a0b805274a65132a2980680ba6b9d. Disable Org link abbreviation expansion or restrict file sources until patched.

How to confirm the fix worked

Confirm Emacs version is at least 29.4 and Org Mode at least 9.7.5; test that %(...) abbreviations referencing unsafe functions are rejected or sanitized; review package manager output for the listed fixed Debian versions or commit hash.

Typical attack path

1. Attacker creates or modifies an Org file containing a crafted %(...) link abbreviation referencing an unsafe function.
2. Victim opens the file in Emacs or triggers Org export/linking operations.
3. org-link-expand-abbrev evaluates the unsafe function without restriction.
4. Arbitrary commands execute on the host with the privileges of the Emacs process.

How to detect it

Search Emacs process logs, Org export logs, and shell history for invocations of shell-command-to-string or similar unsafe functions triggered during link expansion; inspect recently opened Org files for unusual %(...) patterns.

• %(
• shell-command-to-string
• org-link-expand-abbrev

What your security team should do

• Immediately apply the listed fixed package versions or commit across all Emacs and Org-mode installations.
• Scan Org files and repositories for suspicious %(...) link abbreviations.
• Restrict opening of untrusted Org documents until patches are deployed.
• Monitor EPSS trend and reassess if exploitation activity increases.