CVE-2022-48339
low-risk
Published 2023-02-20
An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.
Do I need to act?
-
0.11% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10
High
LOCAL
/ LOW complexity
Affected Products (1)
Emacs
Affected Vendors
References (10)
Third Party Advisory
https://www.debian.org/security/2023/dsa-5360
Third Party Advisory
https://www.debian.org/security/2023/dsa-5360
29
/ 100
low-risk
Severity
24/34 · High
Exploitability
0/34 · Minimal
Exposure
5/34 · Minimal