Incomplete Emacs CVE-2024-53920 fix still allows code execution

Bas Alberts of the GitHub Security Lab has found that the fix for CVE-2024-53920, an arbitrary code execution flaw in GNU Emacs, was incomplete. Viewing or editing untrusted text files in modes other than Emacs Lisp mode can still allow arbitrary code execution, for example when a file enables flymake alongside another major mode.

The issue affects every Emacs version that was vulnerable to CVE-2024-53920: Emacs 24 and newer, and possibly older releases as well.

Emacs maintainers have queued a minimal fix for Emacs 31.2. Sean Whitton said upstream does not plan to backport it to older releases itself. The stopgap is stricter than the change already on the development branch and also implicitly disables the Eglot flymake backend; maintainers expect to reverse that part before 31.2 ships. Whitton has asked for a new CVE for the incomplete fix.