Is CVE-2026-108976 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108976 being exploited in the wild.

How severe is CVE-2026-108976?

High severity, with a CVSS score of 7.8, published 11 October 2026.

Which products and versions are affected?

Gnu Emacs before 31.2; Gnu TRAMP through 2.8.2.

How is CVE-2026-108976 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-108976?

Check whether you run Gnu Emacs or Gnu TRAMP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108976: GNU Emacs command injection via TRAMP user field in filename

CVE-2026-108976 · Severity: high · CVSS 7.8 · Published 2026-10-11

GNU Emacs and TRAMP, which provide remote file editing capabilities over SSH and other protocols, fail to properly validate filenames. An attacker can craft a specially formatted filename that executes arbitrary shell commands on the local system when the file is accessed, even without a successful remote connection—a zero-click attack that requires only opening or checking a malicious file path.

Technologies: Gnu Emacs. Vendors: Gnu.

Quick answers

Is CVE-2026-108976 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108976 being exploited in the wild.
How severe is CVE-2026-108976?: High severity, with a CVSS score of 7.8, published 11 October 2026.
Which products and versions are affected?: Gnu Emacs before 31.2; Gnu TRAMP through 2.8.2.
Is there a fix for CVE-2026-108976?: Yes: fixed in GNU Emacs 31.2; GNU TRAMP 2.8.3 or later. Until then: Restrict access to untrusted files and directories, especially symlinks with TRAMP-formatted targets, or disable TRAMP if remote file editing is not required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108976 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-108976?: Check whether you run Gnu Emacs or Gnu TRAMP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: GNU Emacs 31.2; GNU TRAMP 2.8.3 or later

Restrict access to untrusted files and directories, especially symlinks with TRAMP-formatted targets, or disable TRAMP if remote file editing is not required.

Technical details

The vulnerability exists in TRAMP's tramp-user-regexp, which does not adequately restrict characters in the user field of file paths like /ssh:user@host:/path. Characters such as $, (, ), ;, and backticks are permitted, allowing shell metacharacter injection. When tramp-maybe-open-connection builds a login command by unquoted concatenation of arguments, these payloads execute in the local shell spawned for connection setup. Additionally, tramp-build-prefix-regexp uses line-anchoring instead of string-anchoring, allowing embedded TRAMP paths after a newline to be dispatched to TRAMP handlers, exploitable via symlink targets or directory structures.

Affected products

GNU Emacs before 31.2
GNU TRAMP through 2.8.2

Timeline

2026-08-21: disclosed: oss-security mailing list disclosure by Sean Whitton
2026-10-11: advisory: CVE-2026-108976 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.