Problem Description
TRAMP (Transparent Remote (file) Access, Multiple Protocol) is a
part of Emacs that provides an interface for editing remote files
transparently. It builds the login command for a remote connection
from tramp-login-args by joining the expanded values without quoting
and passes the resulting string to a local shell. The user name part
of a remote file name may contain shell metacharacters, and nothing
sanitizes them. Because the file name dispatch regexp was anchored to
the start of a line rather than the start of the string, a file name
containing a newline followed by a remote file name syntax, for
example in a symbolic link target, is handed to TRAMP.
The first fix (CVE-2026-79992), included in Emacs 31.1, excluded
shell metacharacters from TRAMP user names, but tramp-user-regexp
still permitted "!", "#", "&", "," and control characters. User
and host names were also not re-validated after environment variable
expansion, and the values of tramp-default-user and tramp-default-host
were not validated at all. This incomplete fix was assigned
CVE-2026-108976. The commit completing the fix cites CVE-2026-79992
because it was written before the second identifier was published.
The FreeBSD Emacs package versions 31.1,3 through 31.1_2,3 and
emacs-devel snapshots from 32.0.50.20260902 through 32.0.50.20261001
are affected only by CVE-2026-108976.
Impact
Merely processing a crafted file name, for example with
file-exists-p, executes the embedded command with the privileges of
the user running Emacs. No remote connection has to succeed.