CVE-2007-5795: GNU Emacs

Medium severity, CVSS 6.3. EPSS: 0.7% chance of exploitation in the next 30 days.

The hack-local-variables function in Emacs before 22.2, when enable-local-variables is set to :safe, does not properly search lists of unsafe or risky variables, which might allow user-assisted attackers to bypass intended restrictions and modify critical program variables via a file containing a Local variables declaration.

Affected products

• GNU Emacs: up to and including 22.1

Published 2007-11-02. Last modified 2026-06-16.