Re: Fixing security vulnerabilities before new releases

Sean Whitton <[email protected]> writes:

> Óscar Fuentes [29/Jul  4:24pm +02] wrote:
>> For the record: this vulnerability is *very* serious and deserves an
>> urgent release with a mitigation.
>
> Then please feel free to prepare a version of the fix for the emacs-31
> branch.

For Emacs 31, the mitigation can be as simple as:

diff --git a/lisp/vc/vc-hooks.el b/lisp/vc/vc-hooks.el
index 132b9211f88..48b9e3a3638 100644
--- a/lisp/vc/vc-hooks.el
+++ b/lisp/vc/vc-hooks.el
@@ -299,7 +299,8 @@ vc-find-backend-function
   "Return BACKEND-specific implementation of FUN.
 If there is no such implementation, return the default implementation;
 if that doesn't exist either, return nil."
-  (let ((f (vc-make-backend-sym backend fun)))
+  (let* ((read-symbol-shorthands nil)   ; Mitigate CVE-2026-XXXXX
+         (f (vc-make-backend-sym backend fun)))
     (if (fboundp f) f
       ;; Load vc-BACKEND.el if needed.
       (require (intern (concat "vc-" (downcase (symbol-name backend)))))


Best,

Eshel