In elisp-mode.el in GNU Emacs before 30.1

CVE-2024-53920 is a code-injection flaw in GNU Emacs's elisp-mode.el. When a user opens an untrusted .el (Emacs Lisp) file and either invokes elisp-completion-at-point or has Flymake/Flycheck auto-diagnosis enabled, Emacs performs unsafe macro expansion that can execute arbitrary system commands. The PoC is trivial — a single (rx (eval (call-process …))) form is enough to pop a shell. Affected versions span Emacs 26.1 through 29.4 and pre-release builds through 30.0.92. The fix shipped in Emacs 30.1 (released February 2025), which disables Flymake byte-compilation and completion-induced macro expansion for untrusted files.

The vendor CVSS of 7.8 HIGH is technically defensible on paper — AV:L/AC:L/PR:N/UI:R maps to 'user opens a file and something bad happens.' But in enterprise reality, this score dramatically overstates the risk. The affected population is vanishingly small: GNU Emacs holds roughly 0.06–0.1% IDE market share, and this bug only fires in Emacs Lisp editing mode specifically — not when editing Python, YAML, Terraform, or any other language. The attacker must socially engineer a developer into opening a .el file in Emacs with completion or Flymake active. There is no remote vector, no network exposure, no privilege escalation beyond the user's own session, and zero evidence of in-the-wild exploitation.

Why this verdict

• Population filter: GNU Emacs has ~0.1% IDE market share. In a 10,000-host enterprise, the expected number of Emacs-for-Elisp-development workstations is in the single digits — possibly zero.
• Social engineering required: The attacker must deliver a .el file and convince the victim to open it in Emacs. This is a targeted spear-phishing prerequisite, not a spray-and-pray vector.
• No network attack surface: AV:L means there is nothing to scan, nothing to exploit remotely, and no exposure to reduce. The entire chain is user-initiated.
• Role multiplier: Emacs is a developer workstation tool. It is not a domain controller, hypervisor, identity provider, CI/CD server, or any high-value-role component. Even if the chain succeeds, the blast radius is a single developer's user-space session — not fleet, domain, or supply-chain scale. No high-value-role floor applies.
• No exploitation evidence: Zero KEV listing, zero GreyNoise/campaign data, EPSS at 0.6% — the threat community has not operationalized this in 22 months since disclosure.

Why not higher?

Despite the trivial PoC, there is no remote attack vector, no privilege escalation beyond user context, and the affected population in any enterprise is negligibly small. The blast radius is strictly one workstation session. Upgrading to MEDIUM would require either evidence of active exploitation or a materially larger exposed population — neither exists.

Why not lower?

A public, trivial PoC does exist and the impact on a successfully targeted Emacs Lisp developer is full user-context code execution (C:H/I:H/A:H). Marking IGNORE would understate the risk for the rare enterprise that has a dedicated Emacs Lisp development team. LOW correctly signals 'patch when convenient, no urgency.'

1. Disable Flymake and Flycheck for untrusted Elisp buffers — Add (setq elisp-flymake-byte-compile nil) to site-wide Emacs config or set flymake-mode to nil in emacs-lisp-mode-hook for files outside trusted directories. This eliminates the primary auto-trigger. No SLA — treat as backlog hygiene.
2. Set enable-local-eval to nil — Prevents file-local variables from enabling Flymake or other unsafe evaluations. Add (setq enable-local-eval nil) to the site default.el. Closes the secondary vector where a malicious file-local header re-enables Flymake.
3. Upgrade to Emacs 30.1+ — The definitive fix. Emacs 30.1 disables Flymake byte-compilation and completion-induced macro expansion for untrusted files. Roll out via package manager when convenient — no urgent SLA.

Run on any Linux/macOS host where Emacs is installed. Execute as the regular user: bash check_cve_2024_53920.sh. No elevated privileges required.

#!/usr/bin/env bash
# CVE-2024-53920 checker — GNU Emacs elisp-mode unsafe macro expansion
# Run on target host. No root required.

if ! command -v emacs &>/dev/null; then
  echo "UNKNOWN — Emacs is not installed on this host."
  exit 2
fi

VERSION=$(emacs --version 2>/dev/null | head -1 | grep -oP '[0-9]+\.[0-9]+')
if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not determine Emacs version."
  exit 2
fi

MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)

# Fixed in 30.1+
if [ "$MAJOR" -gt 30 ]; then
  echo "PATCHED — Emacs $VERSION is >= 30.1."
  exit 0
elif [ "$MAJOR" -eq 30 ] && [ "$MINOR" -ge 1 ]; then
  echo "PATCHED — Emacs $VERSION is >= 30.1."
  exit 0
else
  echo "VULNERABLE — Emacs $VERSION is affected by CVE-2024-53920 (fixed in 30.1)."
  exit 1
fi

Sources

1. Eshel Yaron — Emacs Arbitrary Code Execution write-up and PoC
2. GitHub Advisory GHSA-8737-h7fg-9xgj
3. GNU Emacs 30.1 release announcement (oss-security)
4. Ubuntu CVE tracker — CVE-2024-53920
5. Red Hat CVE entry — CVE-2024-53920
6. SentinelOne Vulnerability Database — CVE-2024-53920
7. 6sense — GNU Emacs market share data