What’s Vulnerable › Vulnerabilities

CVE-2022-48339

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-02-20 · updated 2026-06-17
• Weakness: CWE-116

Description

An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.

Affected products

• GNU Emacs: through 28.2

References

• https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=1b4dc4691c1f87fc970fbe568b43869a15ad0d4c
• https://lists.debian.org/debian-lts-announce/2023/05/msg00008.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FLPQ4K6H2S5TY3L5UDN4K4B3L5RQJYQ6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6HDBUQNAH2WL4MHWCTUZLN7NGF7CHTK/
• https://www.debian.org/security/2023/dsa-5360
• https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=1b4dc4691c1f87fc970fbe568b43869a15ad0d4c
• https://lists.debian.org/debian-lts-announce/2023/05/msg00008.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FLPQ4K6H2S5TY3L5UDN4K4B3L5RQJYQ6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6HDBUQNAH2WL4MHWCTUZLN7NGF7CHTK/
• https://www.debian.org/security/2023/dsa-5360

Get alerted when CVE-2022-48339 or the next vulnerability affects your stack