CVE-2023-27985

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=d32091199ae5de590a83f1542a01d75fba000467Issue Tracking, Patch
http://www.openwall.com/lists/oss-security/2023/03/09/1Mailing List, Patch
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=60204Issue Tracking, Patch
https://www.gabriel.urdhr.fr/2023/06/08/emacsclient-mail-shell-elisp-injections/
https://www.openwall.com/lists/oss-security/2023/03/08/2Mailing List, Patch
http://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=d32091199ae5de590a83f1542a01d75fba000467Issue Tracking, Patch
http://www.openwall.com/lists/oss-security/2023/03/09/1Mailing List, Patch
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=60204Issue Tracking, Patch
https://www.gabriel.urdhr.fr/2023/06/08/emacsclient-mail-shell-elisp-injections/
https://www.openwall.com/lists/oss-security/2023/03/08/2Mailing List, Patch

Timeline

Published: Mar 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-279867.8emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped CVE-2023-279879.1In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obta CVE-2023-279887.2The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.13)C0 could allow an authe CVE-2023-279896.5A buffer overflow vulnerability in the CGI program of the Zyxel NR7101 firmware versions prior to V1.00(ABUV.8)C0 could allow a remote auth CVE-2023-27999.8A vulnerability, which was classified as problematic, has been found in cnoa OA up to 5.1.1.5. Affected by this issue is some unknown functi CVE-2023-279904.8The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 CVE-2023-279918.8The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX CVE-2023-279929.8The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware vers CVE-2023-279937.1A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary dire CVE-2023-279958.8A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiSOAR 7.3.0 through 7.3.1 allows an au CVE-2023-279979.8A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below,CVE-2023-279985.3A lack of custom error pages vulnerability [CWE-756] in FortiPresence versions 1.2.0 through 1.2.1 and all versions of 1.1 and 1.0 may allow