High
Security advisory
An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-48339
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 17:13 UTC · Revision 1
Source evidence
An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.
osv:CVE-2022-48339
Complete source record
{
"id": "bdf60ef9607b5a6f1f94aba684f253696a1b4f99b454316a1420f39e8ea56ba8",
"url": "https://osv.dev/vulnerability/CVE-2022-48339",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2022-48339",
"summary": "An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.",
"evidence": "osv:CVE-2022-48339",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2022-48339",
"aliases": [
"CVE-2022-48339"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://cgit.git.savannah.gnu.org/cgit/emacs.git",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "1b4dc4691c1f87fc970fbe568b43869a15ad0d4c"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "1b4dc4691c1f87fc970fbe568b43869a15ad0d4c"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
},
{
"repo": "https://https.git.savannah.gnu.org/git/emacs.git/",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "739b5d0e52d83ec567bd61a5a49ac0e93e0eb469"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "28.2"
}
],
"source": "DESCRIPTION"
},
{
"cpe": "cpe:2.3:a:gnu:emacs:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "28.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"emacs-28.2",
"emacs-28.1.91",
"emacs-28.1.90",
"emacs-28.1",
"emacs-28.0.92",
"emacs-28.0.91",
"emacs-28.0.90",
"emacs-pretest-23.1.92",
"emacs-pretest-23.1.91",
"emacs-pretest-23.1.90",
"emacs-pretest-23.0.95",
"mh-e-8.2",
"mh-e-doc-8.2",
"emacs-pretest-23.0.94",
"emacs-pretest-23.0.93",
"emacs-pretest-23.0.92",
"emacs-pretest-23.0.91",
"emacs-pretest-23.0.90",
"mh-e-doc-8.1",
"mh-e-8.1",
"emacs-pretest-22.0.98",
"emacs-pretest-22.0.97",
"emacs-pretest-22.0.96",
"emacs-pretest-22.0.95",
"emacs-pretest-22.0.94",
"emacs-pretest-22.0.93",
"emacs-pretest-22.0.92",
"emacs-pretest-22.0.91",
"mh-e-8.0.3",
"mh-e-doc-8.0.3",
"emacs-pretest-22.0.90",
"mh-e-8.0.2",
"mh-e-doc-8.0.1",
"mh-e-8.0.1",
"mh-e-doc-8.0",
"mh-e-8.0",
"ttn-vms-21-2-B4",
"emacs-pretest-21.0.106",
"emacs-pretest-21.0.105",
"emacs-pretest-21.0.104",
"emacs-pretest-21.0.103",
"emacs-pretest-21.0.102",
"emacs-pretest-21.0.101",
"emacs-pretest-21.0.100",
"emacs-pretest-21.0.99",
"emacs-pretest-21.0.98",
"emacs-pretest-21.0.97",
"emacs-pretest-21.0.96",
"emacs-pretest-21.0.95",
"emacs-pretest-21.0.93",
"emacs-pretest-21.0.92",
"emacs-pretest-21.0.91",
"emacs-pretest-21.0.90",
"emacs-20.4",
"emacs-20.3",
"emacs-20.2",
"emacs-20.1",
"emacs-19.34"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48339.json"
}
}
],
"modified": "2026-10-27T02:49:34.902749467Z",
"provider": "osv",
"references": [
"https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=1b4dc4691c1f87fc970fbe568b43869a15ad0d4c",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48339.json",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FLPQ4K6H2S5TY3L5UDN4K4B3L5RQJYQ6/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6HDBUQNAH2WL4MHWCTUZLN7NGF7CHTK/",
"https://nvd.nist.gov/vuln/detail/CVE-2022-48339",
"https://www.debian.org/security/2023/dsa-5360",
"https://lists.debian.org/debian-lts-announce/2023/05/msg00008.html"
],
"provider_metadata": {
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48339.json"
}
},
"related_cves": [
{
"value": "CVE-2022-48339",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 460113,
"published_at": "2023-02-20T00:00:00+00:00"
}