Name: CVE-2026-79992: Improper Neutralization of Special Elements used in an OS Command
Creator: Rapid7
Published: 2026-08-25T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-79992, CWE-78, CVSS 7.8, EPSS 0.00145

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.

CVSS Details

CVSS 3.1 Base Score: 7.8
CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade emacs-commonUpgrade emacs-noxUpgrade emacs-filesystemUpgrade emacs-terminalUpgrade emacs-lucidUpgrade emacs	Oct 12, 2026	Oct 12, 2026
Amazon Linux Ami 2	—	Upgrade emacs-lucidUpgrade emacs-develUpgrade emacs-commonUpgrade emacs-debuginfoUpgrade emacsUpgrade emacs-terminalUpgrade emacs-filesystemUpgrade emacs-nox	Oct 19, 2026	Oct 19, 2026
Amazon_linux_2023	—	Upgrade emacs-nox-debuginfoUpgrade emacs-filesystemUpgrade emacsUpgrade emacs-terminalUpgrade emacs-commonUpgrade emacs-lucid-debuginfoUpgrade emacs-common-debuginfoUpgrade emacs-noxUpgrade emacs-debuginfoUpgrade emacs-lucidUpgrade emacs-develUpgrade emacs-debugsource	Sep 30, 2026	Aug 25, 2026
Gentoo Linux	—	Upgrade app-editors/emacs.	Aug 26, 2026	Aug 24, 2026
Redhat_linux	—	Upgrade emacs-nwUpgrade emacs-common-debuginfoUpgrade emacs-commonUpgrade emacs-noxUpgrade emacs-nw-debuginfoUpgrade emacs-debuginfoUpgrade emacs-gtk+x11-debuginfoUpgrade emacs-debugsourceUpgrade emacs-nox-debuginfoUpgrade emacs-filesystemNo solution existsUpgrade emacs-terminalUpgrade emacs-lucid-debuginfoUpgrade emacs-lucidUpgrade emacs	Aug 27, 2026	Aug 21, 2026
Rocky_linux	—	Upgrade emacs-lucid-debuginfoUpgrade emacs-nox-debuginfoUpgrade emacs-commonUpgrade emacs-debugsourceUpgrade emacs-common-debuginfoUpgrade emacs-lucidUpgrade emacs-noxUpgrade emacs-debuginfoUpgrade emacs	Oct 15, 2026	Oct 13, 2026

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence