CVE-2024-53920 Code injection in n/a
Attackers can execute arbitrary code by tricking users into completing or diagnosing untrusted Emacs Lisp source code in GNU Emacs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-53920?
CVE-2024-53920 is a high-severity code injection vulnerability in n/a, published on 27 Nov 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)
Weakness: CWE-94
Which versions are affected by CVE-2024-53920?
It affects 1 product.
Linux distribution packages (40)
emacs AlmaLinux:8 | All versions | 1:26.1-15.el8_10 |
emacs-common AlmaLinux:8 | All versions | 1:26.1-15.el8_10 |
emacs-lucid AlmaLinux:8 | All versions | 1:26.1-15.el8_10 |
emacs-nox AlmaLinux:8 | All versions | 1:26.1-15.el8_10 |
emacs-terminal AlmaLinux:8 | All versions | 1:26.1-15.el8_10 |
emacs AlmaLinux:9 | All versions | 1:27.2-11.el9_5.2 |
emacs AlmaLinux:9 | All versions | 1:27.2-14.el9_6.2 |
emacs-common AlmaLinux:9 | All versions | 1:27.2-11.el9_5.2 |
emacs-common AlmaLinux:9 | All versions | 1:27.2-14.el9_6.2 |
emacs-filesystem AlmaLinux:9 | All versions | 1:27.2-11.el9_5.2 |
emacs-filesystem AlmaLinux:9 | All versions | 1:27.2-14.el9_6.2 |
emacs-lucid AlmaLinux:9 | All versions | 1:27.2-11.el9_5.2 |
emacs-lucid AlmaLinux:9 | All versions | 1:27.2-14.el9_6.2 |
emacs-nox AlmaLinux:9 | All versions | 1:27.2-11.el9_5.2 |
emacs-nox AlmaLinux:9 | All versions | 1:27.2-14.el9_6.2 |
emacs Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-15.el8_10 |
emacs-common Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-15.el8_10 |
emacs-common-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-15.el8_10 |
emacs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-15.el8_10 |
emacs-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-15.el8_10 |
emacs-lucid Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-15.el8_10 |
emacs-lucid-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-15.el8_10 |
emacs-nox Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-15.el8_10 |
emacs-nox-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-15.el8_10 |
emacs-terminal Red Hat:enterprise_linux:8::appstream | All versions | 1:26.1-15.el8_10 |
emacs Red Hat:enterprise_linux:8::baseos | All versions | 1:26.1-15.el8_10 |
emacs-filesystem Red Hat:enterprise_linux:8::baseos | All versions | 1:26.1-15.el8_10 |
emacs Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-11.el9_5.2 |
emacs Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-14.el9_6.2 |
emacs-common Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-11.el9_5.2 |
emacs-common Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-14.el9_6.2 |
emacs-common-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-11.el9_5.2 |
emacs-common-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-14.el9_6.2 |
emacs-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-11.el9_5.2 |
emacs-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-14.el9_6.2 |
emacs-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-11.el9_5.2 |
emacs-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-14.el9_6.2 |
emacs-filesystem Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-11.el9_5.2 |
emacs-filesystem Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-14.el9_6.2 |
emacs-lucid Red Hat:enterprise_linux:9::appstream | All versions | 1:27.2-11.el9_5.2 |
Products include Gnu Emacs.
How do I fix CVE-2024-53920?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-53920 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-53920 exists.
Other vulnerabilities in n/a
Sources
Also known as ALSA-2025:11030, ALSA-2025:4787, ALSA-2025:9448, AZL-53558, AZL-53703, DEBIAN-CVE-2024-53920 and 15 more.