Sploitus

CVE-2024-39331

No indexed exploits for CVE-2024-39331 yet

In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.

Affected products
Alt Linux, Almalinux, Astra Linux, Centos, Debian, Emacs, Linuxmint, Org Mode
Gnu Emacs
< 29.4
Fix
Available
CVSS 3.1
9.8 CRITICAL
EPSS
1.3% (68th percentile)
Weakness
CWE-94
NVD status
Analyzed
Published
2024-06-23
CVE-2024-39331 at NVD
Authoritative description, scoring and affected products

No indexed exploits for CVE-2024-39331 yet

Our index is partial: it proves presence, never absence

No exploit for CVE-2024-39331 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.