Re: CVE-2026-79992: local shell command injection through the user field in emacs tramp

Sam James <[email protected]> writes:

Hi,

>> I see that CVE-2026-79992 has been reported against TRAMP, but is
>> quite vague (https://www.cve.org/CVERecord?id=CVE-2026-79992).  Does
>> anyone know more about it, and whether it is already fixed on some
>> branch(es)?  I don’t see anything obviously related in the Emacs
>> bugtracker.
>
> See https://www.openwall.com/lists/oss-security/2026/08/21/1.
>
> I think it's only fixed on the emacs-31 and master branches. We did
> backports downstream, listed at
> https://www.openwall.com/lists/oss-security/2026/08/24/3.
>
> commit f3e7104d05bdb8e32ba13bf75604108ad88536dc
> Author:     Michael Albinus <[email protected]>
> AuthorDate: Fri Aug 21 14:23:38 2026 +0200
> Commit:     Michael Albinus <[email protected]>
> CommitDate: Fri Aug 21 14:23:38 2026 +0200
>
>     Restrict Tramp user name
>
> ...
>
> is the fix.

Yes. It will be available on GNU ELPA with Tramp 2.8.2.2, later this
week.

There is also a companion fix in tramp-rpc, also in the master
branch. <https://github.com/ArthurHeymans/emacs-tramp-rpc>.

The details of a possible attack are non-public. According to my
knowledge, it hasn't been exploited yet.

> sam

Best regards, Michael.