GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793267784 advisory.

  - GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-     user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete     fix for CVE-2026-79992. (CVE-2026-108976)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3338 advisory.

    GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-     user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete     fix for CVE-2026-79992. (CVE-2026-108976)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of emacs installed on the remote host is prior to 27.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4046 advisory.

    GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-     user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete     fix for CVE-2026-79992. (CVE-2026-108976)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4893-1 advisory.

    - CVE-2026-79992: zero-click local command execution via TRAMP (bsc#1275927).
    - CVE-2026-108976: flawed username input regex validation in TRAMP can cause arbitrary OS command     injection       (bsc#1284345, bsc#1284990).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792623317 advisory.

  - GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-     user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete     fix for CVE-2026-79992. (CVE-2026-108976)

  - A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing     maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper     sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code     execution. (CVE-2026-79992)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792623317 advisory.

  - GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-     user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete     fix for CVE-2026-79992. (CVE-2026-108976)

  - A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing     maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper     sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code     execution. (CVE-2026-79992)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 436ad1a7-ccc8-11f1-af18-c4ff99d93a55 advisory.

    TRAMP (Transparent Remote (file) Access, Multiple Protocol) is a               part of Emacs that provides an interface for editing remote files               transparently.  It builds the login command for a remote connection               from tramp-login-args by joining the expanded values without quoting               and passes the resulting string to a local shell.  The user name part               of a remote file name may contain shell metacharacters, and nothing               sanitizes them.  Because the file name dispatch regexp was anchored to               the start of a line rather than the start of the string, a file name               containing a newline followed by a remote file name syntax, for               example in a symbolic link target, is handed to TRAMP.
    The first fix (CVE-2026-79992), included in Emacs 31.1, excluded               shell metacharacters from TRAMP user names, but tramp-user-regexp               still permitted !, #, &, , and control characters.  User               and host names were also not re-validated after environment variable               expansion, and the values of tramp-default-user and tramp-default-host               were not validated at all.  This incomplete fix was assigned               CVE-2026-108976.  The commit completing the fix cites CVE-2026-79992               because it was written before the second identifier was published.
              The FreeBSD Emacs package versions 31.1,3 through 31.1_2,3 and               emacs-devel snapshots from 32.0.50.20260902 through 32.0.50.20261001               are affected only by CVE-2026-108976.
    Merely processing a crafted file name, for example with               file-exists-p, executes the embedded command with the privileges of               the user running Emacs.  No remote connection has to succeed.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1176 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-108976:
    GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-     user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete     fix for CVE-2026-79992.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792080478 advisory.

  - GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-     user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete     fix for CVE-2026-79992. (CVE-2026-108976)

  - GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an     attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated     max color index. The image loader multiplies image dimensions and channel count using signed integer     arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds     check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-     read contents are interpreted as pixel color values and rendered on screen. (CVE-2026-77219)

  - A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing     maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper     sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code     execution. (CVE-2026-79992)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-     user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete     fix for CVE-2026-79992. (CVE-2026-108976)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
375208	CentOS Linux 7 [TuxCare] Security Update: emacs / emacs-common / emacs-el / emacs-filesystem / emacs-nox / etc (CENTOS7:CLSA-2026:1793267784)	Nessus	CentOS Local Security Checks	Local	high
374397	Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2026-3338)	Nessus	Amazon Linux Local Security Checks	Local	high
374325	Amazon Linux 2 : emacs (ALAS-2026-4046)	Nessus	Amazon Linux Local Security Checks	Local	high
371936	SUSE SLED15 / SLES15 Security Update : emacs (SUSE-SU-2026:4893-1)	Nessus	SuSE Local Security Checks	Local	high
370237	Rocky Linux 9.6 [TuxCare] Security Update: emacs / emacs-common / emacs-devel / emacs-filesystem / emacs-lucid / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792623317)	Nessus	Rocky Linux Local Security Checks	Local	high
370226	AlmaLinux 9.6 [TuxCare] Security Update: emacs / emacs-common / emacs-devel / emacs-filesystem / emacs-lucid / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792623317)	Nessus	Alma Linux Local Security Checks	Local	high
369538	FreeBSD : Emacs -- Local command injection via crafted file names in TRAMP (436ad1a7-ccc8-11f1-af18-c4ff99d93a55)	Nessus	FreeBSD Local Security Checks	Local	high
367403	TencentOS Server 4: emacs (TSSA-2026:1176)	Nessus	Tencent Local Security Checks	Local	high
366236	AlmaLinux 9.2 [TuxCare] Security Update: emacs / emacs-common / emacs-devel / emacs-filesystem / emacs-lucid / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792080478)	Nessus	Alma Linux Local Security Checks	Local	medium
365501	Linux Distros Unpatched Vulnerability : CVE-2026-108976	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-108976

high

Tenable Plugins

high

high

high

high

high

high

high

high

medium

high