Emacs TRAMP zero-click flaw runs local shell commands

Bas Alberts of the GitHub Security Lab has found a critical local command-execution bug in GNU Emacs TRAMP, the package that lets Emacs treat remote files as if they were local. The issue affects Emacs 30.2 and may reach earlier releases.

TRAMP assembles a login command from remote path components and feeds it, unquoted, to a local shell it has already started. The username portion of a remote file name is barely filtered, so shell metacharacters such as dollar signs, backticks, and parentheses remain legal. Merely probing a path that embeds a payload in the user field, for example by asking whether the file exists, is enough to run arbitrary local commands. No SSH session needs to succeed; the damage happens on the local side during setup.

A second weakness makes the first easier to reach. Once TRAMP is loaded, its file-name handler matches a line-anchored pattern rather than a whole-string one. Any name that merely contains a newline followed by a remote-style path can be dispatched into the vulnerable logic, even when the path is not a clean TRAMP name from start to finish.

Michael Albinus, the TRAMP maintainer, prepared a fix. Sean Whitton published the disclosure on the oss-security list.