Executive Summary

In GNU Emacs (pre‑30.1), invoking elisp-completion-at-point or enabling on‑the‑fly diagnosis on untrusted Emacs Lisp source triggers unsafe macro expansion, allowing attackers to execute arbitrary code. The flaw exists in elisp-mode.el and can be exploited by supplying crafted Lisp code that expands during completion or byte‑compilation.

---

Authoritative CVE Metadata - CVSS Base Score: 7.8 (HIGH) - Published: 2024-11-27T15:15:26.837 - Last Modified: 2026-08-20T16:17:03.930

Original Description: In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)

"Let us revere, let us worship, but erect and open-eyed, the highest, not the lowest; the future, not the past!"

— Charlotte Gilman