Skip to content
Fencer Vulns
high 8.8

CVE-2025-1244 json

Emacs: shell injection vulnerability in gnu emacs via custom "man" uri scheme

published 2025-02-12 20 mo ago modified 2026-11-04 4 d ago also EUVD-2025-2098

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.6%
EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 1:24.3-23.el7_9.2
  • Red Hat Red Hat Enterprise Linux 8 1:26.1-13.el8_10
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 1:26.1-5.el8_2.3
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 1:26.1-5.el8_4.3
  • Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service 1:26.1-5.el8_4.3
  • Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions 1:26.1-5.el8_4.3
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 1:26.1-7.el8_6.6
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 1:26.1-7.el8_6.6
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 1:26.1-7.el8_6.6
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support 1:26.1-10.el8_8.7
  • Red Hat Red Hat Enterprise Linux 9 1:27.2-11.el9_5.1
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 1:27.2-6.el9_0.2
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support 1:27.2-8.el9_2.2
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 1:27.2-10.el9_4.1
  • Red Hat Builds for Red Hat OpenShift 1.3.2 1.3.1-1741784043
  • emacs Debian 12 1:28.2+1-15+deb12u4
  • emacs Debian 14, Debian 13 1:30.1+1-1

debian advisories DEBIAN-CVE-2025-1244

  • emacs Ubuntu Pro 20.04 LTS 1:26.3+1-1ubuntu2+esm2
  • emacs Ubuntu Pro 22.04 LTS 1:27.1+1-3ubuntu5.2+esm1
  • emacs Ubuntu Pro 24.04 LTS 1:29.3+1-1ubuntu2+esm3

ubuntu advisories UBUNTU-CVE-2025-1244

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • emacs RHEL 9 1:27.2-11.el9_5.1
  • emacs-nox RHEL 9 1:27.2-11.el9_5.1
  • emacs-lucid RHEL 9 1:27.2-11.el9_5.1
  • emacs-common RHEL 9 1:27.2-11.el9_5.1
  • emacs-filesystem RHEL 9 1:27.2-11.el9_5.1
  • emacs RHEL 8 1:26.1-13.el8_10
  • emacs-nox RHEL 8 1:26.1-13.el8_10
  • emacs-lucid RHEL 8 1:26.1-13.el8_10

red hat advisories RHSA-2025:2195RHSA-2025:2130RHSA-2025:2157RHSA-2025:2022RHSA-2025:1963RHSA-2025:1964

  • emacs SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +10 more 27.2-150400.3.23.2
  • emacs SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 25.3-150000.3.25.3
  • emacs SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 24.3-25.23.1

suse advisories SUSE-SU-2025:0599-1SUSE-SU-2025:0589-1SUSE-SU-2025:0574-1

  • emacs openSUSE Tumbleweed 29.4-14.1

opensuse advisories openSUSE-SU-2025:14767-1

  • emacs AlmaLinux 9 1:27.2-11.el9_5.1
  • emacs-nox AlmaLinux 9 1:27.2-11.el9_5.1
  • emacs-lucid AlmaLinux 9 1:27.2-11.el9_5.1
  • emacs-common AlmaLinux 9 1:27.2-11.el9_5.1
  • emacs-filesystem AlmaLinux 9 1:27.2-11.el9_5.1
  • emacs AlmaLinux 8 1:26.1-13.el8_10
  • emacs-nox AlmaLinux 8 1:26.1-13.el8_10
  • emacs-lucid AlmaLinux 8 1:26.1-13.el8_10

almalinux advisories ALSA-2025:1915ALSA-2025:1917

  • emacs Rocky Linux 9 1:27.2-11.el9_5.1
  • emacs Rocky Linux 8 1:26.1-13.el8_10

rocky linux advisories RLSA-2025:1915RLSA-2025:1917

  • emacs CBL-Mariner 2.0, Azure Linux 3.0 29.4-2

azure linux advisories AZL-56713AZL-56729

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-1244 updated cvss 8.8

emacs: Shell Injection Vulnerability in GNU Emacs via Custom "man" URI Scheme

  • Red Hat Enterprise Linux 6 emacs, emacs-el, emacs-nox, emacs-common
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Builds for Red Hat OpenShift 1.3.2 openshift-builds 1.3.1-1741784043
    fixed: vendor fix RHSA-2025:2754
  • Red Hat Enterprise Linux AppStream (v. 8) emacs 26.1-13.el8_10, emacs-nox 26.1-13.el8_10, emacs-lucid 26.1-13.el8_10, emacs-common 26.1-13.el8_10, emacs-terminal 26.1-13.el8_10
    fixed: vendor fix RHSA-2025:1917
  • Red Hat Enterprise Linux AppStream (v. 9) emacs 27.2-11.el9_5.1, emacs-nox 27.2-11.el9_5.1, emacs-lucid 27.2-11.el9_5.1, emacs-common 27.2-11.el9_5.1, emacs-filesystem 27.2-11.el9_5.1
    fixed: vendor fix RHSA-2025:1915
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) emacs 26.1-5.el8_2.3, emacs-nox 26.1-5.el8_2.3, emacs-lucid 26.1-5.el8_2.3, emacs-common 26.1-5.el8_2.3, emacs-terminal 26.1-5.el8_2.3
    fixed: vendor fix RHSA-2025:2157
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) emacs 26.1-5.el8_4.3, emacs-nox 26.1-5.el8_4.3, emacs-lucid 26.1-5.el8_4.3, emacs-common 26.1-5.el8_4.3, emacs-terminal 26.1-5.el8_4.3
    fixed: vendor fix RHSA-2025:1963
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) emacs 26.1-7.el8_6.6, emacs-nox 26.1-7.el8_6.6, emacs-lucid 26.1-7.el8_6.6, emacs-common 26.1-7.el8_6.6, emacs-terminal 26.1-7.el8_6.6
    fixed: vendor fix RHSA-2025:1961
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) emacs 26.1-5.el8_4.3, emacs-nox 26.1-5.el8_4.3, emacs-lucid 26.1-5.el8_4.3, emacs-common 26.1-5.el8_4.3, emacs-terminal 26.1-5.el8_4.3
    fixed: vendor fix RHSA-2025:1963
show 18 more
  • Red Hat Enterprise Linux AppStream E4S (v.8.6) emacs 26.1-7.el8_6.6, emacs-nox 26.1-7.el8_6.6, emacs-lucid 26.1-7.el8_6.6, emacs-common 26.1-7.el8_6.6, emacs-terminal 26.1-7.el8_6.6
    fixed: vendor fix RHSA-2025:1961
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) emacs 27.2-6.el9_0.2, emacs-nox 27.2-6.el9_0.2, emacs-lucid 27.2-6.el9_0.2, emacs-common 27.2-6.el9_0.2, emacs-filesystem 27.2-6.el9_0.2
    fixed: vendor fix RHSA-2025:2022
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) emacs 26.1-10.el8_8.7, emacs-nox 26.1-10.el8_8.7, emacs-lucid 26.1-10.el8_8.7, emacs-common 26.1-10.el8_8.7, emacs-terminal 26.1-10.el8_8.7
    fixed: vendor fix RHSA-2025:1962
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) emacs 27.2-8.el9_2.2, emacs-nox 27.2-8.el9_2.2, emacs-lucid 27.2-8.el9_2.2, emacs-common 27.2-8.el9_2.2, emacs-filesystem 27.2-8.el9_2.2
    fixed: vendor fix RHSA-2025:1964
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) emacs 27.2-10.el9_4.1, emacs-nox 27.2-10.el9_4.1, emacs-lucid 27.2-10.el9_4.1, emacs-common 27.2-10.el9_4.1, emacs-filesystem 27.2-10.el9_4.1
    fixed: vendor fix RHSA-2025:2195
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) emacs 26.1-5.el8_4.3, emacs-nox 26.1-5.el8_4.3, emacs-lucid 26.1-5.el8_4.3, emacs-common 26.1-5.el8_4.3, emacs-terminal 26.1-5.el8_4.3
    fixed: vendor fix RHSA-2025:1963
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) emacs 26.1-7.el8_6.6, emacs-nox 26.1-7.el8_6.6, emacs-lucid 26.1-7.el8_6.6, emacs-common 26.1-7.el8_6.6, emacs-terminal 26.1-7.el8_6.6
    fixed: vendor fix RHSA-2025:1961
  • Red Hat Enterprise Linux BaseOS (v. 8) emacs 26.1-13.el8_10, emacs-filesystem 26.1-13.el8_10
    fixed: vendor fix RHSA-2025:1917
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) emacs 26.1-5.el8_2.3, emacs-filesystem 26.1-5.el8_2.3
    fixed: vendor fix RHSA-2025:2157
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) emacs 26.1-5.el8_4.3, emacs-filesystem 26.1-5.el8_4.3
    fixed: vendor fix RHSA-2025:1963
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) emacs 26.1-7.el8_6.6, emacs-filesystem 26.1-7.el8_6.6
    fixed: vendor fix RHSA-2025:1961
  • Red Hat Enterprise Linux BaseOS E4S (v.8.4) emacs 26.1-5.el8_4.3, emacs-filesystem 26.1-5.el8_4.3
    fixed: vendor fix RHSA-2025:1963
  • Red Hat Enterprise Linux BaseOS E4S (v.8.6) emacs 26.1-7.el8_6.6, emacs-filesystem 26.1-7.el8_6.6
    fixed: vendor fix RHSA-2025:1961
  • Red Hat Enterprise Linux BaseOS EUS (v.8.8) emacs 26.1-10.el8_8.7, emacs-filesystem 26.1-10.el8_8.7
    fixed: vendor fix RHSA-2025:1962
  • Red Hat Enterprise Linux BaseOS TUS (v.8.4) emacs 26.1-5.el8_4.3, emacs-filesystem 26.1-5.el8_4.3
    fixed: vendor fix RHSA-2025:1963
  • Red Hat Enterprise Linux BaseOS TUS (v.8.6) emacs 26.1-7.el8_6.6, emacs-filesystem 26.1-7.el8_6.6
    fixed: vendor fix RHSA-2025:1961
  • Red Hat Enterprise Linux Server (v. 7 ELS) emacs 24.3-23.el7_9.2, emacs-nox 24.3-23.el7_9.2, emacs-common 24.3-23.el7_9.2, emacs-filesystem 24.3-23.el7_9.2 Red Hat Enterprise Linux Server Optional (v. 7 ELS) emacs-el 24.3-23.el7_9.2, emacs-terminal 24.3-23.el7_9.2
    fixed: vendor fix RHSA-2025:2130
  • Red Hat Builds for Red Hat OpenShift 1.3.2 openshift-builds 1.3.1-1741768114, openshift-builds 1.3.1-1741770382, openshift-builds 1.3.1-1741771156, openshift-builds 1.3.1-1741772590, openshift-builds 1.3.1-1741782941, openshift-builds 1.3.1-1741784401, +3 more Red Hat Enterprise Linux 10 emacs
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction

2.63% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Builds for Red Hat OpenShift 1.3.2
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.