CVE-2022-48339: GNU Emacs

High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days.

An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.

Affected products

• GNU Emacs: up to and including 28.2

Published 2023-02-20. Last modified 2026-06-17.