FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

emacs -- arbitary shell command execution vulnerability of ctags

Affected packages
emacs < 28.2_2,3
emacs-canna < 28.2_2,3
emacs-nox < 28.2_2,3
emacs-devel <,2
emacs-devel-nox <,2


VuXML ID 76e2fcce-92d2-11ed-a635-080027f5fec9
Discovery 2022-11-28
Entry 2023-01-12

lu4nx reports:

GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input.


CVE Name CVE-2022-45939