Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 23 Jun 2024 08:41:15 +0000
From: Ihor Radchenko <>
Subject: Arbitrary shell command evaluation in Org mode (GNU Emacs)


Here is a vulnerability in Emacs Org mode.

Reproducer is the following .org file:

#+LINK: shell %(shell-command-to-string)
[[shell:touch ~/hacked.txt]]

When sent by email and previewed in Emacs or when opened in Emacs as a
file, the above Org file will evaluate "touch ~/hacked.txt" without any

The fix is attached. It is against Org mode git repository.
The fix can be applied to older versions of Org mode/Emacs if deemed

The fix has been included into Emacs 29.4 and Org 9.7.5 (released

View attachment "v3-0001-org-link-expand-abbrev-Do-not-evaluate-arbitrary-.patch" of type "text/x-patch" (2931 bytes)

Ihor Radchenko // yantar92,
Org mode contributor,
Learn more about Org mode at <>.
Support Org development at <>,
or support my work at <>

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.