Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-53920

In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)

Published

2024-11-27T15:15:26.837

Last Modified

2025-04-30T16:21:59.130

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 7.8 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-94
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application gnu emacs < 30.1 Yes
References