CVE-2023-2491 Command injection in emacs

High 7.8 Published 17 May 2023 Updated 22 Jan 2025

Attackers can execute arbitrary commands via crafted org-mode code in Emacs, requiring users to apply vendor patches.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-2491?

CVE-2023-2491 is a high-severity command injection vulnerability in Redhat Enterprise Linux, published on 17 May 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Weakness: CWE-77

Which versions are affected by CVE-2023-2491?

It affects 5 products.

Linux distribution packages (12)

`emacs` Red Hat:enterprise_linux:8::appstream	All versions	`1:26.1-10.el8_8.2`
`emacs-common` Red Hat:enterprise_linux:8::appstream	All versions	`1:26.1-10.el8_8.2`
`emacs-common-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`1:26.1-10.el8_8.2`
`emacs-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`1:26.1-10.el8_8.2`
`emacs-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`1:26.1-10.el8_8.2`
`emacs-lucid` Red Hat:enterprise_linux:8::appstream	All versions	`1:26.1-10.el8_8.2`
`emacs-lucid-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`1:26.1-10.el8_8.2`
`emacs-nox` Red Hat:enterprise_linux:8::appstream	All versions	`1:26.1-10.el8_8.2`
`emacs-nox-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`1:26.1-10.el8_8.2`
`emacs-terminal` Red Hat:enterprise_linux:8::appstream	All versions	`1:26.1-10.el8_8.2`
`emacs` Red Hat:enterprise_linux:8::baseos	All versions	`1:26.1-10.el8_8.2`
`emacs-filesystem` Red Hat:enterprise_linux:8::baseos	All versions	`1:26.1-10.el8_8.2`

Products include Gnu Emacs, Redhat Enterprise Linux, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Server Aus, Redhat Enterprise Linux Server Tus.

How do I fix CVE-2023-2491?

Apply the vendor's patch.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-2491 being exploited?

There is no known exploitation of CVE-2023-2491 in the wild and no public exploit code.

All Redhat Enterprise Linux vulnerabilities

Sources

Also known as GHSA-2hj6-9wp7-hvmh, RHSA-2023:3104.