{"uuid": "2fff31fb-94ca-4cf4-bc4e-63b7e8fea481", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108976", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117424129025361042", "content": "CVE-2026-108976  GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108976https://ftp.gnu.org/gnu/tramp/tramp-2.8.2.tar.gzhttps://www.openwall.com/lists/oss-security/2026/10/11/1https://www.openwall.com/lists/oss-security/2026/08/21/1#gnu #GNU #Emacs#CVE_2026_108976#bot", "creation_timestamp": "2026-10-11T20:20:16.162164Z"}