VDB
DEBIAN-CVE-2024-39331
DEBIAN-CVE-2024-39331
PUBLISHED
CVSS 9.800000190734863 CRITICAL
In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.
Risk Scores
CVSS v3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:11 | emacs | 1:27.1+1-3.1+deb11u4, 1:27.1+1-3.1+deb11u3, 0 |
| Debian:11 | org-mode | 0, *, 9.4.0+dfsg |
| Debian:13 | emacs | 0, 0 |
| Debian:12 | emacs | 1:28.2+1-15, 0, 28.2+1 |
| Debian:12 | org-mode | *, 9.7.36+dfsg, 9.7.5+dfsg |
| Debian:14 | org-mode | 0, 0 |
| Debian:13 | org-mode | 0, 0 |
| Debian:14 | emacs | 0, 0 |
Timeline
- Jun 23, 2024 CVE Published
- Apr 28, 2026 CVE Updated