Home > Vulnerability Database > CVE-2023-27986

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2023-27986

Date: March 8, 2023

emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. It is fixed in 29.0.90.

Language: EMACS_LISP

Severity Score

7.8

Related Resources (7)

Url: http://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=3c1693d08b0a71d40a77e7b40c0ebc42dca2d2cc

Url: https://www.openwall.com/lists/oss-security/2023/03/08/2

Url: https://www.gabriel.urdhr.fr/2023/06/08/emacsclient-mail-shell-elisp-injections/

Url: http://www.openwall.com/lists/oss-security/2023/03/09/1

Url: https://nvd.nist.gov/vuln/detail/CVE-2023-27986

Url: https://security-tracker.debian.org/tracker/CVE-2023-27986

Url: https://www.mend.io/vulnerability-database/CVE-2023-27986

Severity Score

7.8

Weakness Type (CWE)

Code Injection

CWE-94

CVSS v3.1

Base Score:	7.8
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	REQUIRED
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Do you need more information?

Contact Us