CVE-2022-48339: gnu emacs Improper Encoding or Escaping of Output
Vulnerability summary
CVE-2022-48339 is a high (CVSS 7.8) Improper Encoding or Escaping of Output vulnerability in gnu emacs. EPSS estimates a 1.14% chance of exploitation in the next 30 days, higher than 66.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 12 · Related 5Timeline
- 20-02-2023PublishedVulnerability first disclosed.
- 18-03-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · Red hatEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.14%
Chance of exploitation in the next 30 days
Percentile
66%
Versus all other CVEs
30-day change
0.00 pp
From 1.14% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
- CWE-1116Inaccurate Source Code CommentsThe source code contains comments that do not accurately describe or explain aspects of the portion of the code with which the comment is associated.
Affected systems
Redhat7 products
- emacs< 1:24.3-23.el7_9.1
- emacs-common< 1:24.3-23.el7_9.1
- emacs-debuginfo< 1:24.3-23.el7_9.1
- emacs-el< 1:24.3-23.el7_9.1
- emacs-filesystem< 1:24.3-23.el7_9.1
Ubuntu5 products
- emacs< 1:26.3+1-1ubuntu2+esm1 | < 1:27.1+1-3ubuntu5.2
- emacs24< 24.5+1-6ubuntu1.1+esm2
- emacs25< 25.2+1-6ubuntu0.1~esm2
- xemacs21All versions (No fix recorded)
- xemacs21-packagesAll versions (No fix recorded)
Debian1 product
- emacs< 1:28.2+1-11
Gnu1 product
- emacs≤ 28.2
4 vendors · 14 products
References
16 links
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
