GNU Org Mode vulnerabilities

5 CVEs affecting GNU Org Mode, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-30205, published 2024-03-25.

More from GNU.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-30202, published 2024-03-25. High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days. In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.
• CVE-2024-30203, published 2024-03-25. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. In Emacs before 29.3, Gnus treats inline MIME contents as trusted.
• CVE-2024-30205, published 2024-03-25. High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days. In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23.
• CVE-2024-30204, published 2024-03-25. Low severity, CVSS 2.8. EPSS: 0.5% chance of exploitation in the next 30 days. In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments.
• CVE-2023-28617, published 2023-03-19. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.