In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.
CVE-2024-39331
CVSS base score
9.8 (v3.1)
Severity
CRITICAL
Attack vector
Network
Weakness
CWE-94
Last modified
November 3, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
gnu emacs
References
- git.savannah.gnu.org Release Notes
- git.savannah.gnu.org Mailing List, Patch
- list.orgmode.org Mailing List
- lists.debian.org Mailing List
- lists.debian.org Mailing List
- lists.gnu.org Mailing List
- news.ycombinator.com Mailing List
- www.openwall.com Mailing List
- www.openwall.com Mailing List
- git.savannah.gnu.org Release Notes