CVE-2022-48339

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-116 CWE-1116

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Feb 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-48345.4The CPT Bootstrap Carousel WordPress plugin through 1.12 does not validate and escape some of its shortcode attributes before outputting the CVE-2022-483407.5In Gluster GlusterFS 11.0, there is an xlators/cluster/dht/src/dht-common.c dht_setxattr_mds_cbk use-after-free.CVE-2022-483418.8ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain Sy CVE-2022-483429.8In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents.CVE-2022-483436.1In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.CVE-2022-483446.1In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process.CVE-2022-483456.1sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.CVE-2022-483467.5The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect confidentiality.CVE-2022-483477.5The MediaProvider module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect confidenti CVE-2022-483489.1The MediaProvider module has a vulnerability of unauthorized data read. Successful exploitation of this vulnerability may affect confidentia CVE-2022-483499.1The control component has a spoofing vulnerability. Successful exploitation of this vulnerability may affect confidentiality and availabilit CVE-2022-48355.4The Social Sharing Toolkit WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them