CVE-2026-108976

A flaw was found in Emacs. Processing a specially crafted filename with TRAMP can cause an OS command execution because tramp-user-regexp has an incomplete list of disallowed inputs. This vulnerability exists due to an incomplete fix of CVE-2026-79992.

To exploit this issue, a user needs to open or process a specially crafted filename using the TRAMP package, limiting the possibility of exploitation. However, as this issue allows OS command execution, it has been rated with an important severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, do not open or process untrusted filenames or interact with remote systems that may contain specially crafted filenames.