---
id: CVE-2026-79992
title: 'Emacs: emacs: command injection via crafted filenames in tramp'
summary: >-
  A flaw was found in Emacs TRAMP. A local attacker could exploit this
  vulnerability by processing maliciously crafted filenames. This occurs because
  TRAMP concatenates login arguments without proper sanitization, which are then
  passed to …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-78
vendor: Red Hat
product: emacs
affected:
  - emacs (all versions)
  - emacs (all versions)
  - emacs (all versions)
  - emacs (all versions)
  - emacs (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-25T17:32:22.093371Z'
published: '2026-08-25'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:22:00.674Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-79992'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-79992'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2523665'
    label: RHBZ#2523665
tags:
  - cve.org
epss: 0.00198
epssPercentile: 0.08463
ingestedAt: '2026-09-24T20:51:40.352Z'
---

## Overview

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.

## Affected

- `emacs (all versions)`
- `emacs (all versions)`
- `emacs (all versions)`
- `emacs (all versions)`
- `emacs (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Users of Emacs TRAMP should avoid processing untrusted filenames or interacting with remote systems that may contain maliciously crafted file names. This operational control reduces the risk of local shell command injection.