CVE-2025-1244CWE-78command-injection

CVE-2025-1244

High · published February 12, 2025

CVSS v3.1
8.8
EPSS
3%
Percentile
85.4
In the wild
Unconfirmed
What it is

A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02632 · 85.4th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-02-12T20:15Z
References (18)
https://access.redhat.com/errata/RHSA-2025:1915 · [email protected]https://access.redhat.com/errata/RHSA-2025:1917 · [email protected]https://access.redhat.com/errata/RHSA-2025:1961 · [email protected]https://access.redhat.com/errata/RHSA-2025:1962 · [email protected]https://access.redhat.com/errata/RHSA-2025:1963 · [email protected]https://access.redhat.com/errata/RHSA-2025:1964 · [email protected]https://access.redhat.com/errata/RHSA-2025:2022 · [email protected]https://access.redhat.com/errata/RHSA-2025:2130 · [email protected]https://access.redhat.com/errata/RHSA-2025:2157 · [email protected]https://access.redhat.com/errata/RHSA-2025:2195 · [email protected]https://access.redhat.com/errata/RHSA-2025:2754 · [email protected]https://access.redhat.com/security/cve/CVE-2025-1244 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2345150 · [email protected]https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=820f0793f0b46448928905552726c1f1b999062f · [email protected]http://www.openwall.com/lists/oss-security/2025/03/01/2 · af854a3a-2127-422b-91ae-364da2661108https://debbugs.gnu.org/cgi/bugreport.cgi?bug=66390 · af854a3a-2127-422b-91ae-364da2661108https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-30.1 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2025/02/msg00033.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 12 FEB 14:27Z
    Emacs: shell injection vulnerability in gnu emacs via custom "man" uri scheme
    cvelistv5