PT-2023-21467
CVE-2023-27985
·
Published
2023-03-09
·
Updated
2026-10-01
Description by
CVSS 3.1
7.8
HighMetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Emacs versions 28.1 through 28.2
Description
The issue is related to a lack of compliance with the Desktop Entry Specification, allowing shell command injections through a crafted mailto: URI. This affects emacsclient-mail.desktop.
Recommendations
For versions 28.1 through 28.2, update to version 29.0.90 to resolve the issue. As a temporary workaround, consider restricting the use of mailto: URIs in emacsclient-mail.desktop until the update is applied.
Found an issue in the description? Have something to add? Feel free to write us 👾