INFSA-2025:9448: emacs security update

Information about definition

Identificator: INFSA-2025:9448

Type: security

Release date: 2025-07-07 18:10:09 UTC

Information about package

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.

Vulnerabilities description

  • CVE-2024-53920

    In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)

Severity level

CVE Score CVSS 2.0 Score CVSS 3.x Score CVSS 4.0
no information 7.8 no information
Critical, important, moderate, low

Updated packages