Emacs Once Again Found to Execute Code When Opening a File

Eshel Yaron has reported a new arbitrary-code-execution vulnerability in the Emacs editor — a year and a half after the previous note on the same subject. This time the problem involves the Emacs Lisp symbol shorthands mechanism, introduced in Emacs 28.1.

What happens

A specially crafted file can run arbitrary, attacker-controlled Emacs Lisp code the moment it is opened — before the malicious content is even shown on screen. What makes it especially nasty is that the exploit can be carried by any file, regardless of its name or extension, and requires no special settings at all: the default configuration is vulnerable. Stefan Monnier has published a proof of concept in the Emacs bug tracker.

The vulnerability affects all versions of Emacs from 28.1 onward, including 31.0.91 — the latest Emacs 31 pretest build at the time of publication. No released version contains a fix yet. A CVE has been requested but not yet assigned.

How to protect yourself

Commit 8466eb44, which landed in the emacs-31 branch on August 5, 2026, mitigates the issue: it binds read-symbol-shorthands to nil around several risky intern calls in two files. The change is small and self-contained, so it can easily be cherry-picked into earlier versions. Releasing separate security updates for versions already out is, according to the author, not currently planned — the matter was discussed on the emacs-devel mailing list.

For users of Emacs 30 and newer, the author offers his trust-manager package, which addresses the problem more bluntly: in untrusted files it disables symbol shorthands entirely. Finally, you can approximate the effect of the fix without rebuilding the editor with a small configuration snippet that advises vc-find-backend-function and c-compose-keywords-list to suppress shorthand processing.

In the master branch the problem has been dealt with more fundamentally: the intern and intern-soft functions no longer consult read-symbol-shorthands, which severs the dangerous link between symbol shorthands and interning. That fix, however, will only appear in Emacs 32.

Source: Lobsters