CVE-2024-53920

What it actually does

Invoking elisp-completion-at-point or enabling on-the-fly byte compilation on untrusted Emacs Lisp source triggers unsafe macro expansion that executes attacker-controlled code.

Why it matters to the business

Attackers can run arbitrary commands on developer workstations that edit untrusted Lisp files, leading to credential theft, persistence, or lateral movement with low probability of mass exploitation.

How an attack unfolds

An attacker supplies a malicious .el file containing a Lisp macro that performs side effects during expansion. The victim opens the file and either manually requests completion at a point or has flymake/flycheck byte-compilation enabled, causing the macro to execute and deliver a payload.

How to fix it

Upgrade Emacs to a patched release: Debian 11 users to 1:27.1+1-3.1+deb11u6, Debian 12 users to 1:28.2+1-15+deb12u4, or Git checkout 8ac894e2246f25d2a2a97d866b10e6e0b0fede5a. Disable elisp-completion-at-point and byte-compilation features for untrusted buffers until patches are applied.

How to confirm the fix worked

Confirm the running Emacs binary reports a version string matching or newer than the listed fixed releases and test that completion on a sample macro-containing buffer no longer evaluates side effects.

Typical attack path

1. Attacker crafts Emacs Lisp source containing a macro with side-effecting forms
2. Victim receives or clones the untrusted .el file
3. Victim invokes completion or enables on-the-fly diagnosis on the file
4. Unsafe macro expansion executes attacker code inside the Emacs process
5. Attacker obtains shell access or further persistence on the workstation

How to detect it

Review shell history, Emacs *Messages* buffers, and process creation logs on developer hosts for unexpected Lisp evaluation or child processes spawned shortly after editing .el files; no high-fidelity network or file IOCs are known.

What your security team should do

• Apply the listed package updates on all developer systems within the next sprint
• Add Emacs version checks to configuration-management and image-building pipelines
• Educate users to avoid enabling completion or diagnostics on files from untrusted sources
• Monitor EPSS and KEV feeds for any future increase in exploit maturity