GNU Emacs TRAMP: the August fix for zero-click command execution was incomplete; crafted remote file names can still run local shell commands (CVE-2026-108976, CVSS 7.8); patch posted, no fixed Emacs release yet

Emacs maintainer Sean Whitton disclosed on the oss-security list on 11 October 2026 that the fix for CVE-2026-79992 was incomplete. CVE-2026-79992 is the TRAMP local command execution flaw that Bas Alberts of GitHub Security Lab reported in August. Wonyoung Jung of 78ResearchLab, using its PatchHawk tool, found that tramp-user-regexp still let through characters such as !, #, &, comma and control characters in the user part of a remote file name, so a crafted name can still inject commands into the local shell TRAMP opens while it sets up a connection. The original August report showed that merely checking such a file name, for example through a symlink target committed to a git repository or a recursive directory scan, ran the payload before any SSH connection was made. MITRE assigned CVE-2026-108976 on 11 October (CVSS 3.1 7.8, local attack vector) for Emacs before 31.2 and TRAMP through 2.8.2. A patch by TRAMP maintainer Michael Albinus is attached to the post; it will ship in Emacs 31.2, which the maintainers say will not be released soon. No exploitation has been reported.

Product

GNU Emacs (TRAMP remote file access)

Versions

Emacs before 31.2; TRAMP through 2.8.2 (CVE record). GNU ELPA's newest TRAMP package, 2.8.2.3 (29 Sep 2026), predates this disclosure.

CVSS

7.8 (CVSS 3.1, CVE record)

Exploited in Australia?

unknown

Patch to

No fixed Emacs release yet. Apply the Albinus patch from the oss-security post (tramp.el and tramp-archive.el) or take your distribution's patched Emacs package when it ships, then move to Emacs 31.2 when released. Until then, avoid opening or recursively scanning untrusted repositories and archives in Emacs.

Primary: oss-security — Sean Whitton (Emacs maintainer): Incomplete fix for Emacs CVE-2026-79992 (11 Oct 2026) · Vendor: GNU ELPA — TRAMP package (maintainer Michael Albinus) · CVE: CVE-2026-108976, CVE-2026-79992 · CVE.org — CVE-2026-108976 (11 Oct 2026); original report: oss-security 2026/08/21/1

vulnerabilities