GNU Emacs TRAMP OS Command Injection via Incomplete tramp-user-regexp Blocklist

#!/usr/bin/env bash
# check_cve_2026_108976.sh
# Checks whether the local Emacs installation is vulnerable to CVE-2026-108976
# (TRAMP tramp-user-regexp incomplete input blocklist)
# Exit codes: 0 = PATCHED/NOT AFFECTED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

# Check if Emacs is installed
if ! command -v emacs &>/dev/null; then
  echo "PATCHED — Emacs is not installed on this host."
  exit 0
fi

EMACS_VERSION=$(emacs --version 2>/dev/null | head -1 | grep -oP '[0-9]+\.[0-9]+(\.[0-9]+)?')

if [ -z "$EMACS_VERSION" ]; then
  echo "UNKNOWN — Could not determine Emacs version."
  exit 2
fi

echo "Detected Emacs version: $EMACS_VERSION"

# Parse major.minor
MAJOR=$(echo "$EMACS_VERSION" | cut -d. -f1)
MINOR=$(echo "$EMACS_VERSION" | cut -d. -f2)

# Check if Emacs >= 31.2 (patched upstream)
if [ "$MAJOR" -gt 31 ]; then
  echo "PATCHED — Emacs $EMACS_VERSION is >= 31.2."
  exit 0
elif [ "$MAJOR" -eq 31 ] && [ "$MINOR" -ge 2 ]; then
  echo "PATCHED — Emacs $EMACS_VERSION is >= 31.2."
  exit 0
fi

# For versions < 31.2, check TRAMP version via Emacs Lisp
TRAMP_VERSION=$(emacs --batch --eval '(progn (require (quote tramp) nil t) (if (boundp (quote tramp-version)) (princ tramp-version) (princ "unknown")))' 2>/dev/null || echo "unknown")

echo "Detected TRAMP version: $TRAMP_VERSION"

if [ "$TRAMP_VERSION" = "unknown" ]; then
  # TRAMP not loadable or version not detectable — check distro patch
  # Attempt to check if distro backported the fix via changelog
  if command -v dpkg &>/dev/null; then
    if dpkg -s emacs-common 2>/dev/null | grep -qi 'CVE-2026-108976'; then
      echo "PATCHED — Distro package contains CVE-2026-108976 fix."
      exit 0
    fi
  elif command -v rpm &>/dev/null; then
    if rpm -q --changelog emacs-common 2>/dev/null | grep -qi 'CVE-2026-108976'; then
      echo "PATCHED — Distro package contains CVE-2026-108976 fix."
      exit 0
    fi
  fi
  echo "VULNERABLE — Emacs $EMACS_VERSION (< 31.2) with indeterminate TRAMP version. Assume vulnerable."
  exit 1
fi

# Compare TRAMP version — fixed in 2.8.3
TRAMP_MAJOR=$(echo "$TRAMP_VERSION" | cut -d. -f1)
TRAMP_MINOR=$(echo "$TRAMP_VERSION" | cut -d. -f2)
TRAMP_PATCH=$(echo "$TRAMP_VERSION" | cut -d. -f3)
TRAMP_PATCH=${TRAMP_PATCH:-0}

if [ "$TRAMP_MAJOR" -gt 2 ]; then
  echo "PATCHED — TRAMP $TRAMP_VERSION is >= 2.8.3."
  exit 0
elif [ "$TRAMP_MAJOR" -eq 2 ] && [ "$TRAMP_MINOR" -gt 8 ]; then
  echo "PATCHED — TRAMP $TRAMP_VERSION is >= 2.8.3."
  exit 0
elif [ "$TRAMP_MAJOR" -eq 2 ] && [ "$TRAMP_MINOR" -eq 8 ] && [ "$TRAMP_PATCH" -ge 3 ]; then
  echo "PATCHED — TRAMP $TRAMP_VERSION is >= 2.8.3."
  exit 0
fi

# Check distro-level backport
if command -v dpkg &>/dev/null; then
  if dpkg -s emacs-common 2>/dev/null | grep -qi 'CVE-2026-108976'; then
    echo "PATCHED — Distro package contains CVE-2026-108976 backport."
    exit 0
  fi
elif command -v rpm &>/dev/null; then
  if rpm -q --changelog emacs-common 2>/dev/null | grep -qi 'CVE-2026-108976'; then
    echo "PATCHED — Distro package contains CVE-2026-108976 backport."
    exit 0
  fi
fi

echo "VULNERABLE — Emacs $EMACS_VERSION with TRAMP $TRAMP_VERSION (< 2.8.3). CVE-2026-108976 applies."
exit 1