CVE-2026-79992: Emacs TRAMP RCE Vulnerability

CVE-2026-79992 Overview

A command injection flaw exists in Emacs TRAMP (Transparent Remote Access, Multiple Protocols). The vulnerability allows a local attacker to execute arbitrary code by supplying a maliciously crafted filename. TRAMP concatenates login arguments without proper sanitization and then passes the resulting string to a local shell. This behavior enables shell metacharacter injection during filename processing.

The issue is tracked under CWE-78: Improper Neutralization of Special Elements used in an OS Command. The flaw affects Emacs installations where TRAMP is used to open or reference remote files.

Critical Impact
Local attackers can achieve arbitrary code execution in the context of the Emacs user by tricking TRAMP into processing filenames containing shell metacharacters.

Affected Products

GNU Emacs (TRAMP component)
Red Hat Enterprise Linux distributions shipping affected Emacs packages
Downstream Linux distributions bundling vulnerable Emacs versions

Discovery Timeline

2026-08-25 - CVE-2026-79992 published to NVD
2026-08-26 - Public discussion on the Openwall OSS Security list
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79992

Vulnerability Analysis

TRAMP is the Emacs subsystem that provides transparent access to remote files over protocols such as SSH, SCP, and rsync. When TRAMP opens a remote path, it constructs a login command by concatenating user-controllable components including the hostname, username, and method arguments. The concatenation logic does not neutralize shell metacharacters before the resulting string is handed to a local shell for execution.

A local attacker who can influence a filename processed by Emacs, for example by placing a crafted file in a shared directory or convincing a user to open a specific path, can inject shell commands. Execution occurs in the security context of the Emacs process, which typically runs as the interactive user. The attack requires only low privileges and does not require user interaction beyond the filename being processed by TRAMP.

Root Cause

The root cause is missing input sanitization in TRAMP's login argument construction. TRAMP treats filename components as trusted string data and interpolates them directly into a shell command line. Characters with shell semantics, such as backticks, $(), semicolons, and pipes, are neither escaped nor rejected. This is a classic OS command injection pattern classified under [CWE-78].

Attack Vector

Exploitation requires local access with the ability to introduce a filename that Emacs will process through TRAMP. Practical delivery paths include filenames in shared filesystems, entries in editor bookmarks, project files, dired listings, or automation scripts that pass paths to Emacs. When TRAMP parses the malicious path and invokes the local shell for the login step, the injected command executes with the privileges of the Emacs user.

No verified public exploit code is available. The vulnerability mechanism is described in the Red Hat CVE-2026-79992 Advisory and Red Hat Bugzilla #2523665.

Detection Methods for CVE-2026-79992

Indicators of Compromise

Unexpected child processes of emacs invoking /bin/sh, /bin/bash, or interpreters such as python, perl, or curl.
Filenames or path arguments in process telemetry containing shell metacharacters such as backticks, $(...), ;, |, or &&.
Outbound network connections initiated by processes spawned from an Emacs session shortly after opening a remote file.
Modifications to shell startup files, SSH authorized_keys, or cron entries following Emacs activity.

Detection Strategies

Monitor process ancestry for shells spawned by emacs with command lines that contain TRAMP method prefixes such as /ssh:, /scp:, or /sudo:.
Alert on execution of arbitrary binaries as children of Emacs where the command line contains suspicious substitution syntax.
Correlate filesystem events for crafted filenames in world-writable directories with subsequent Emacs process activity.

Monitoring Recommendations

Enable command-line and process-tree auditing on Linux hosts where Emacs is used interactively or by automation.
Log and review TRAMP method invocations by capturing execve events for shells launched with login-style arguments.
Track file creation events in shared or network-mounted directories to identify staged attack filenames.

How to Mitigate CVE-2026-79992

Immediate Actions Required

Apply vendor updates for Emacs and the TRAMP package as soon as they are available from your distribution.
Avoid opening untrusted files or directories in Emacs, particularly paths sourced from shared or network locations.
Review automation and editor integrations that pass filenames to Emacs and validate that inputs cannot contain shell metacharacters.

Patch Information

Refer to the Red Hat CVE-2026-79992 Advisory for package versions and errata specific to Red Hat Enterprise Linux. Track your Linux distribution's security channel for Emacs updates that include the sanitization fix in TRAMP's login argument handling.

Workarounds

Disable or avoid TRAMP by not invoking remote file syntax such as /ssh:user@host:/path until patched packages are installed.
Restrict Emacs use to trusted directories and reject filenames containing shell metacharacters at the filesystem or workflow layer.
Run Emacs under least-privilege accounts to reduce the impact of successful command injection.

bash

# Configuration example: disable TRAMP autoload in init.el as a temporary workaround
(setq tramp-mode nil)