Emacs

This hub aggregates every CVE we track for Emacs, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Emacs.

• CVE-2026-6861Emacs: emacs: memory corruption vulnerability when processing svg css6.1Apr 22, 2026
• CVE-2025-1244Emacs: shell injection vulnerability in gnu emacs via custom "man" uri scheme8.8Feb 12, 2025
• CVE-2024-53920In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion t...7.8Nov 27, 2024
• CVE-2024-39331In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.9.8Jun 23, 2024
• CVE-2024-30202In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.7.8Mar 25, 2024
• CVE-2024-30204In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments.2.8Mar 25, 2024
• CVE-2024-30203In Emacs before 29.3, Gnus treats inline MIME contents as trusted.5.5Mar 25, 2024
• CVE-2024-30205In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23.7.1Mar 25, 2024
• CVE-2023-2491A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CV...7.8May 17, 2023
• CVE-2023-28617org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.7.8Mar 19, 2023
• CVE-2023-27986emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. It is fixed in 29.0.90.7.8Mar 9, 2023
• CVE-2023-27985emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specificati...7.8Mar 9, 2023
• CVE-2022-48338An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an intera...7.3Feb 20, 2023
• CVE-2022-48339An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from extern...7.8Feb 20, 2023
• CVE-2022-48337GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementat...9.8Feb 20, 2023