CVE-2026-108976 GNU CVE debrief

Who should care

Defenders responsible for GNU Emacs and TRAMP deployments should assess exposure and apply patches or mitigations to prevent OS command injection. This includes verifying GNU Emacs and TRAMP versions, monitoring for suspicious activity related to TRAMP, and reviewing compensating controls for exposed systems. Security teams and vulnerability management teams should prioritize this vulnerability and take necessary actions to prevent exploitation.

Why it matters

Defenders should prioritize verifying GNU Emacs and TRAMP versions, assessing exposure, and applying patches or mitigations to prevent OS command injection.

• Verify GNU Emacs and TRAMP versions to assess exposure
• Apply patches or mitigations to prevent OS command injection
• Monitor for suspicious activity related to TRAMP

Technical summary

The vulnerability allows OS command injection via a filename in GNU Emacs before 31.2 and TRAMP through 2.8.2 due to an incomplete list of disallowed inputs in tramp-user-regexp. This issue is a result of an incomplete fix for CVE-2026-79992. The vulnerability can be exploited by providing a specially crafted filename, which can lead to unauthorized execution of system commands. Defenders should prioritize verifying GNU Emacs and TRAMP versions, assessing exposure, and applying patches or mitigations to prevent OS command injection.

Defensive priority

Defenders should prioritize verifying GNU Emacs and TRAMP versions, assessing exposure, and applying patches or mitigations.

Recommended defensive actions

• Verify GNU Emacs version and assess exposure
• Apply patches or mitigations for vulnerable versions
• Monitor for suspicious activity related to TRAMP
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. Supplemental sources include product and patch references. The CVE record was published on 2026-10-11T20:11:10.826Z and has not been modified since then. The vulnerability has been publicly disclosed, and defenders should verify GNU Emacs and TRAMP versions to assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.