Command Execution Vulnerability in GNU Emacs Affected by Shell Metacharacters

CVE-2022-45939

Summary

GNU Emacs versions up to 28.2 is susceptible to a command execution vulnerability that arises from the mishandling of shell metacharacters within source-code file names. When using the 'ctags *' command with untrusted input in the current working directory, attackers can exploit this flaw, allowing them to execute arbitrary commands. This vulnerability is facilitated by lib-src/etags.c's reliance on the system C library function, which does not adequately sanitize input. Users are advised to update to secure versions to mitigate risks.

References