---
id: CVE-2024-53920
title: >-
  In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke
  elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source
  code can trigger unsafe Lisp macro expansion that allows attackers to execute
  arbitrar…
summary: >-
  In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke
  elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source
  code can trigger unsafe Lisp macro expansion that allows attackers to execute
  arbitrar…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
vendor: gnu
product: emacs
affected:
  - emacs < 30.1
patched:
  - emacs 30.1
published: '2024-11-27'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T22:16:54.853'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-53920'
references:
  - url: >-
      https://eshelyaron.com/posts/2024-11-27-emacs-aritrary-code-execution-and-how-to-avoid-it.html
    label: cve@mitre.org
  - url: 'https://git.savannah.gnu.org/cgit/emacs.git/tag/?h=emacs-30.0.92'
    label: cve@mitre.org
  - url: 'https://git.savannah.gnu.org/cgit/emacs.git/tree/ChangeLog.4'
    label: cve@mitre.org
  - url: 'https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-30.1'
    label: cve@mitre.org
  - url: 'https://news.ycombinator.com/item?id=42256409'
    label: cve@mitre.org
  - url: >-
      https://yhetil.org/emacs/CAFXAjY5f4YfHAtZur1RAqH34UbYU56_t6t2Er0YEh1Sb7-W=hg@mail.gmail.com/
    label: cve@mitre.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/08/20/3'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2026/08/20/7'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/14/1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/21/9'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/02/msg00033.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53920.json
  - url: 'https://access.redhat.com/security/cve/CVE-2024-53920'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2329161'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2024-53920'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-53920'
  - url: >-
      https://yhetil.org/emacs/CAFXAjY5f4YfHAtZur1RAqH34UbYU56_t6t2Er0YEh1Sb7-W=hg%40mail.gmail.com/
  - url: 'https://access.redhat.com/errata/RHSA-2025:11030'
  - url: 'https://access.redhat.com/errata/RHSA-2025:4794'
  - url: 'https://access.redhat.com/errata/RHSA-2025:4793'
  - url: 'https://access.redhat.com/errata/RHSA-2025:4787'
  - url: 'https://access.redhat.com/errata/RHSA-2025:9448'
  - url: 'https://access.redhat.com/errata/RHSA-2025:11487'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2024-12-02T16:55:56.437957Z'
epss: 0.006
epssPercentile: 0.46588
ingestedAt: '2026-08-20T17:59:03.421Z'
---

## Overview

In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)

## Affected

- `emacs < 30.1`

## Remediation

Upgrade past the affected range:

- `emacs 30.1`

## Vendor advisories

- **RHSA-2025:11030** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux BaseOS (v. 8) · released 2025-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2025:11030)
- **RHSA-2025:4794** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.2) · released 2025-05-12 · [advisory](https://access.redhat.com/errata/RHSA-2025:4794)
- **RHSA-2025:4793** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4) · released 2025-05-12 · [advisory](https://access.redhat.com/errata/RHSA-2025:4793)
- **RHSA-2025:4787** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2025-05-12 · [advisory](https://access.redhat.com/errata/RHSA-2025:4787)
- **RHSA-2025:9448** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2025-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2025:9448)
- **RHSA-2025:11487** · Red Hat · fixed in: Red Hat Discovery 2 · released 2025-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2025:11487)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53920.json)