CVE-2026-79992

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.

This is an Important local shell command injection flaw in Emacs TRAMP. An attacker with local access could exploit this vulnerability by tricking a user into processing a maliciously crafted filename, leading to arbitrary command execution. This issue requires user interaction with a malicious file, limiting its remote exploitability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Users of Emacs TRAMP should avoid processing untrusted filenames or interacting with remote systems that may contain maliciously crafted file names. This operational control reduces the risk of local shell command injection.