Emacs Arbitrary Code Execution and How to Avoid It
Details and advice about a long standing arbitrary code execution vulnerability in Emacs
Created on [2024-11-27], last updated [2024-11-27]
This is a security advisory about CVE-2024-53920, an Emacs
vulnerability that I (re-)discovered a few months ago.
TL;DR
Viewing or editing Emacs Lisp code in Emacs can run arbitrary code.
The vulnerability stems from unsafe Lisp macro-expansion, which runs
unrestricted Emacs Lisp code. Most common configurations are
vulnerable (see details below). The best...
Read more at eshelyaron.com