CVE-2024-30202
emacs: arbitrary Lisp code is evaluated as part of turning on Org mode
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · March 25, 2024
Updated · November 21, 2025
Description
A flaw was found in Emacs. Arbitrary Lisp code can be evaluated when an Org mode file is opened or when the Org mode is being enabled, resulting in arbitrary code execution.
Statement
The Emacs package, as shipped in Red Hat Enterprise Linux 8 and 9, is not affected by this vulnerability because the vulnerable code was introduced in a newer version of Emacs.
To exploit this flaw, an attacker needs to trick a user into opening a crafted Org mode file. For this reason, this flaw has been rated with a Moderate security impact.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Do not open Org mode files from untrusted sources.
CVSS / CWE
CVSS 3.1 · 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')