CVE-2026-108976

What it actually does

The vulnerability permits OS command injection when TRAMP processes filenames that bypass the incomplete tramp-user-regexp check, allowing execution of arbitrary operating system commands with the privileges of the Emacs process.

Why it matters to the business

Attackers can execute arbitrary commands on systems running vulnerable Emacs installations, potentially leading to data theft, system compromise, or disruption of developer workflows that rely on the editor for remote file access.

How an attack unfolds

An attacker crafts a malicious filename containing shell metacharacters that evades the incomplete disallowed-input list in tramp-user-regexp. When a user opens or interacts with the file via TRAMP for remote access, Emacs passes the filename to the shell without proper sanitization, resulting in command execution.

How to fix it

Upgrade GNU Emacs to version 31.2 or later and ensure TRAMP is updated to a version beyond 2.8.2. Until patches are applied, avoid using TRAMP with untrusted remote paths or filenames.

How to confirm the fix worked

Confirm Emacs reports version 31.2 or newer; test that filenames previously capable of injection are now rejected or properly escaped by TRAMP; review changelog entries referencing the incomplete fix for the prior related issue.

Typical attack path

1. Identify systems or workflows using GNU Emacs with TRAMP for remote file operations
2. Create or deliver a file whose name contains shell metacharacters that bypass tramp-user-regexp
3. Trick or wait for a user to open or manipulate the file inside Emacs
4. Emacs invokes the shell with the unsanitized filename, executing attacker-controlled commands

How to detect it

Review shell history logs, Emacs session traces, and process execution logs for unexpected command invocations triggered during file operations involving TRAMP; look for anomalous child processes spawned from Emacs when handling remote files.

What your security team should do

• Prioritize patching Emacs installations that use TRAMP for remote access within the next 30 days
• Scan internal package repositories and developer workstations for versions before 31.2
• Implement application allow-listing or sandboxing for Emacs processes handling external files
• Monitor for future updates addressing similar regexp-based input validation gaps