CVE-2024-39331

CriticalCVSS 9.8/10Last modified Nov 3, 2026

Description

In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
gnu	emacs	< 29.4

References

https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29Release Notes
https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8Mailing List, Patch
https://list.orgmode.org/87sex5gdqc.fsf%40localhost/Mailing List
https://lists.debian.org/debian-lts-announce/2024/06/msg00023.htmlMailing List
https://lists.debian.org/debian-lts-announce/2024/06/msg00024.htmlMailing List
https://lists.gnu.org/archive/html/info-gnu-emacs/2024-06/msg00000.htmlMailing List
https://news.ycombinator.com/item?id=40768225Mailing List
https://www.openwall.com/lists/oss-security/2024/06/23/1Mailing List
https://www.openwall.com/lists/oss-security/2024/06/23/2Mailing List
https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29Release Notes
https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8Mailing List, Patch
https://list.orgmode.org/87sex5gdqc.fsf%40localhost/Mailing List
https://lists.debian.org/debian-lts-announce/2024/06/msg00023.htmlMailing List
https://lists.debian.org/debian-lts-announce/2024/06/msg00024.htmlMailing List
https://lists.gnu.org/archive/html/info-gnu-emacs/2024-06/msg00000.htmlMailing List
https://news.ycombinator.com/item?id=40768225Mailing List
https://www.openwall.com/lists/oss-security/2024/06/23/1Mailing List
https://www.openwall.com/lists/oss-security/2024/06/23/2Mailing List

Timeline

Published: Jun 23, 2024
Last modified: Nov 3, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-393329.8Webswing 23.2.2 allows remote attackers to modify client-side JavaScript code to achieve path traversal, likely leading to remote code execu CVE-2024-393346.5MENDELSON AS4 before 2024 B376 has a client-side vulnerability when a trading partner provides prepared XML data. When a victim opens the de CVE-2024-393359.1Supported versions of Mahara 24.04 before 24.04.1 and 23.04 before 23.04.6 are vulnerable to information being disclosed to an institution a CVE-2024-393376.5Click Studios Passwordstate Core before 9.8 build 9858 allows Authentication Bypass.CVE-2024-393387.5axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.CVE-2024-393397.5A vulnerability has been discovered in all versions of Smartplay headunits, which are widely used in Suzuki and Toyota cars. This misconfigu CVE-2024-39346.5The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to Path Traversal in versions 7.3.0 to 7.5.1 via the mercadopag CVE-2024-393408.8The authentication system of Securepoint UTM mishandles OTP keys. This allows the bypassing of second-factor verification (when OTP is enabl CVE-2024-393415.9Entrust Instant Financial Issuance (On Premise) Software (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier l CVE-2024-393426.6Entrust Instant Financial Issuance (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier uses a DLL library (i.e CVE-2024-393437.0An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, Modem 5123 CVE-2024-393448.1An issue was discovered in the Docusign API package 8.142.14 for Salesforce. The Apttus_DocuApi__DocusignAuthentication__mdt object is insta