CVE-2022-48338 Command injection in n/a
Attackers can execute arbitrary commands via malicious Ruby source files in GNU Emacs due to unescaped parameters in ruby-mode.el.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-48338?
CVE-2022-48338 is a high-severity command injection vulnerability in n/a, published on 20 Feb 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed.
Weakness: CWE-77
Which versions are affected by CVE-2022-48338?
It affects 1 product.
Products include Gnu Emacs.
How do I fix CVE-2022-48338?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-48338 being exploited?
There is no known exploitation of CVE-2022-48338 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as AZL-13681, DEBIAN-CVE-2022-48338, GHSA-hm6m-2xg8-mc5q, UBUNTU-CVE-2022-48338.