CVE-2024-30205 Overview
CVE-2024-30205 is a vulnerability in GNU Emacs versions prior to 29.3 where Org mode treats the contents of remote files as trusted. The flaw impacts Org Mode versions before 9.6.23. When a user opens a remote Org file, Emacs may evaluate embedded code and directives without applying the safety checks that normally protect local file operations. An attacker who can influence a remote file that a user opens can trigger code execution in the victim's Emacs session. The issue is tracked under CWE-494: Download of Code Without Integrity Check and affects Debian Linux distributions that package Emacs.
Critical Impact
An attacker who controls a remote file opened in Org mode can achieve local code execution with the privileges of the Emacs user, compromising integrity and availability of the host.
Affected Products
- GNU Emacs versions before 29.3
- GNU Org Mode versions before 9.6.23
- Debian Linux 10.0 (LTS package)
Discovery Timeline
- 2024-03-25 - CVE-2024-30205 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-30205
Vulnerability Analysis
Org mode is Emacs' outlining, note-taking, and literate-programming environment. It supports embedded source blocks, links, and directives that can trigger evaluation of Emacs Lisp or shell code. For local files, Org mode applies safety prompts and trust checks before executing potentially dangerous content. This vulnerability arises because Org mode applied the same trust assumptions to files fetched from remote sources through TRAMP or similar mechanisms.
A user opening a file such as /ssh:host:/path/to/file.org or an HTTP-fetched Org document could have directives like #+SETUPFILE:, #+INCLUDE:, or file-local variables processed without appropriate confirmation. This allows an attacker who controls the remote content to influence Emacs behavior on the victim's workstation. Because the exploit requires the user to open the crafted file, user interaction is required, but the resulting impact on integrity and availability is high.
Root Cause
Org mode did not distinguish between locally authored files and files whose contents originated from remote hosts. Remote content should be considered untrusted by default, but the code path handling remote buffers inherited the trust posture applied to local files. See the Org Mode commit reference and the GNU Emacs commit reference for the fix details.
Attack Vector
Exploitation requires the victim to open a malicious Org file located on a remote endpoint the attacker controls, or to follow a link that resolves through TRAMP to attacker-controlled content. Once opened, directives that normally require confirmation may execute automatically, leading to arbitrary Emacs Lisp evaluation or shell command execution under the user's account.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Openwall Security Discussion for further technical background.
Detection Methods for CVE-2024-30205
Indicators of Compromise
- Unexpected child processes spawned by the emacs binary, particularly shells or interpreters invoked shortly after opening a remote file.
- TRAMP connections to unfamiliar hosts in ~/.emacs.d/ history or recentf lists.
- Modifications to Emacs initialization files (init.el, .emacs) that were not made by the user.
- Outbound network connections initiated from emacs processes to attacker-controlled infrastructure.
Detection Strategies
- Inventory installed Emacs and Org mode versions across Linux workstations and developer endpoints, flagging any Emacs below 29.3 or Org below 9.6.23.
- Monitor process telemetry for emacs parent processes launching sh, bash, curl, wget, or other suspicious commands.
- Correlate file access to .org files fetched over ssh:, scp:, or http: TRAMP methods with subsequent process or network activity.
Monitoring Recommendations
- Enable auditd or eBPF-based process auditing to log Emacs command executions and child process trees.
- Track outbound network flows from user endpoints where Emacs is installed and alert on anomalies.
- Review Debian LTS advisories DLA-3792 and DLA-3793 for packaged fix versions and validate patch deployment.
How to Mitigate CVE-2024-30205
Immediate Actions Required
- Upgrade GNU Emacs to version 29.3 or later on all affected systems.
- Upgrade standalone Org Mode installations to version 9.6.23 or later.
- Apply Debian LTS security updates for the emacs source package on Debian 10 systems.
- Advise users to avoid opening untrusted Org files from remote sources until patches are applied.
Patch Information
The fix is available in the upstream Emacs 29 branch through commit 2bc865ace050ff118db43f01457f95f95112b877 and in Org Mode through commit 4255d5dcc0657915f90e4fba7e0a5514cced514d. Debian users should install packages announced in Debian LTS Announcement #23 and Debian LTS Announcement #24. See the GNU Emacs News Update for the release notes covering this security fix.
Workarounds
- Disable automatic evaluation of Org source blocks by setting org-confirm-babel-evaluate to t in your Emacs configuration.
- Set enable-local-variables to :safe or nil to prevent file-local variable execution from untrusted buffers.
- Avoid using TRAMP to open Org files hosted on systems outside your administrative control.
- Restrict org-babel-load-languages to the minimum set required for legitimate workflows.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
