GNU bug report logs - #48676
Arbitrary code execution in Org export macros

Previous Next

Full log

Message #21 received at 48676 <at> debbugs.gnu.org (full text, mbox):

From: Stefan Kangas <stefankangas <at> gmail.com>
To: Ihor Radchenko <yantar92 <at> posteo.net>
Cc: Glenn Morris <rgm <at> gnu.org>, 48676 <at> debbugs.gnu.org
Subject: Re: bug#48676: Arbitrary code execution in Org export macros
Date: Fri, 7 Feb 2025 14:11:45 -0800

Glenn Morris <rgm <at> gnu.org> writes:

> Package: emacs,org-mode
> Version: 28.0.50
> Severity: important
> Tags: security
>
> emacs -Q hello.org, where hello.org contains:
>
> #+macro: hello (eval (shell-command-to-string "touch /tmp/HELLO"))
> Hello. {{{hello}}}
>
> Then:
> M-x org-export-dispatch
> t A
>
> -> now /tmp/HELLO exist, with no prompting.
>
> This seems contrary to normal Emacs practice for risky local variables,
> and to the section "Code Evaluation and Security Issues" in the Org manual
> (which does not mention macros).

Ihor, could you please look into this bug?

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.