Is CVE-2026-108976 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-108976?

CVE-2026-108976 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-108976

Description

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.