CVE-2022-48337 – CVE-2022-48337 is a command injection vulnerabi... (How to Fix)

Q: What is the severity of CVE-2022-48337?

CVE-2022-48337 has a CVSS score of 9.8 (CRITICAL). CVE-2022-48337 is a command injection vulnerability in GNU Emacs' etags utility that allows attackers to execute arbitrary commands via shell metacharacters in source-code filenames. This affects users who run etags commands (particularly 'etags -u *' as suggested in documentation) in directories containing untrusted files. The vulnerability has a CVSS score of 9.8 due to its potential for remote code execution with high impact.

📋 TL;DR

CVE-2022-48337 is a command injection vulnerability in GNU Emacs' etags utility that allows attackers to execute arbitrary commands via shell metacharacters in source-code filenames. This affects users who run etags commands (particularly 'etags -u *' as suggested in documentation) in directories containing untrusted files. The vulnerability has a CVSS score of 9.8 due to its potential for remote code execution with high impact.

💻 Affected Systems

Products:

GNU Emacs

Versions: All versions through 28.2

Operating Systems: Linux, Unix-like systems, Windows (via Cygwin/MSYS)

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability is in the etags utility included with Emacs, not the main Emacs editor itself. Affects any use of etags on untrusted filenames.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Emacs by Gnu

View all CVEs affecting Emacs →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise with attacker gaining the privileges of the user running etags, potentially leading to lateral movement, data exfiltration, or ransomware deployment.

🟠

Likely Case

Local privilege escalation or arbitrary command execution in development environments where etags processes untrusted source code files.

🟢

If Mitigated

Limited impact if users don't run etags on untrusted files and follow principle of least privilege.

🌐 Internet-Facing: LOW - etags is typically used locally in development workflows, not exposed directly to internet.

🏢 Internal Only: MEDIUM - Risk exists in development environments where users process untrusted code, but requires user interaction.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires convincing a user to run etags on malicious filenames. The vulnerability is well-documented with public proof-of-concept available in commit references.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Emacs 28.3 and later

Vendor Advisory: https://lists.gnu.org/archive/html/emacs-devel/2023-01/msg00123.html

Restart Required: No

Instructions:

1. Update Emacs to version 28.3 or later. 2. For package managers: 'sudo apt update && sudo apt upgrade emacs' (Debian/Ubuntu) or 'sudo yum update emacs' (RHEL/Fedora). 3. Verify installation with 'emacs --version'.

🔧 Temporary Workarounds

Avoid etags on untrusted directories

all

Do not run etags commands in directories containing untrusted files or filenames.

Use alternative tagging tools

linux

Replace etags with ctags or other tagging utilities that are not vulnerable.

sudo apt install universal-ctags
Use 'ctags' instead of 'etags'

🧯 If You Can't Patch

Restrict etags usage through policy or permissions - remove execute permissions from etags binary for non-privileged users
Implement file integrity monitoring on etags binary and alert on execution in suspicious contexts

🔍 How to Verify

Check if Vulnerable:

Check Emacs version: 'emacs --version' and verify if it's 28.2 or earlier. Also check if etags binary exists and is from vulnerable Emacs package.

Check Version:

emacs --version | head -1

Verify Fix Applied:

After update, verify 'emacs --version' shows 28.3 or later. Test with known safe filenames containing shell metacharacters to ensure no command execution occurs.

📡 Detection & Monitoring

Log Indicators:

Unusual process execution following etags commands
Shell commands with unexpected arguments spawned from etags process

Network Indicators:

Outbound connections from etags process (unexpected)

SIEM Query:

process_name:etags AND (process_args:*;* OR process_args:*&* OR process_args:*|* OR process_args:*`*)

📊 Metadata

CVE ID: CVE-2022-48337

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-78

Published: February 20, 2023

Last Updated: March 18, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-48337, you might also want to check these: