CVE-2023-28617 – This vulnerability allows attackers to execute ... (How to Fix)

Q: What is the severity of CVE-2023-28617?

CVE-2023-28617 has a CVSS score of 7.8 (HIGH). This vulnerability allows attackers to execute arbitrary commands on systems running vulnerable versions of Org Mode for GNU Emacs. Attackers can exploit shell metacharacters in file or directory names when processing LaTeX code blocks, leading to remote code execution. Users of Org Mode through version 9.6.1 are affected.

📋 TL;DR

This vulnerability allows attackers to execute arbitrary commands on systems running vulnerable versions of Org Mode for GNU Emacs. Attackers can exploit shell metacharacters in file or directory names when processing LaTeX code blocks, leading to remote code execution. Users of Org Mode through version 9.6.1 are affected.

💻 Affected Systems

Products:

Org Mode for GNU Emacs

Versions: Through 9.6.1

Operating Systems: All platforms running GNU Emacs with Org Mode

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists in the ob-latex.el component when processing LaTeX code blocks with org-babel-execute:latex function.

📦 What is this software?

Org Mode by Gnu

View all CVEs affecting Org Mode →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise with attacker gaining the same privileges as the Emacs/Org Mode user, potentially leading to data theft, ransomware deployment, or lateral movement.

🟠

Likely Case

Local privilege escalation or arbitrary command execution in the context of the user running Emacs, potentially leading to data access or system modification.

🟢

If Mitigated

Limited impact if proper input validation and sandboxing are in place, with only non-critical file access possible.

🌐 Internet-Facing: LOW - Requires user interaction with malicious Org files, not directly network exploitable.

🏢 Internal Only: MEDIUM - Internal users could craft malicious Org files to target other users, but requires file sharing or collaboration.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW - Requires crafting malicious file/directory names with shell metacharacters.

Exploitation requires user to open or process a malicious Org file containing LaTeX code blocks.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in commits 8f8ec2ccf3f5ef8f38d68ec84a7e4739c45db485 and a8006ea580ed74f27f974d60b598143b04ad1741

Vendor Advisory: https://list.orgmode.org/tencent_04CF842704737012CCBCD63CD654DD41CA0A%40qq.com/T/#m6ef8e7d34b25fe17b4cbb655b161edce18c6655e

Restart Required: Yes

Instructions:

1. Update Org Mode to version after 9.6.1. 2. Apply patches from GNU Emacs repository. 3. Restart Emacs to load patched code.

🔧 Temporary Workarounds

Disable org-babel-execute:latex

all

Prevent execution of LaTeX code blocks in Org Mode

(setq org-babel-default-header-args:latex '((:results . "none")))

Input validation for file names

all

Sanitize file and directory names before processing

🧯 If You Can't Patch

Restrict user access to only trusted Org files from verified sources
Implement strict file permission controls and monitor for unusual Emacs/Org Mode process activity

🔍 How to Verify

Check if Vulnerable:

Check Org Mode version with: M-x org-version

Check Version:

M-x org-version

Verify Fix Applied:

Verify version is greater than 9.6.1 and test with safe file names containing shell metacharacters

📡 Detection & Monitoring

Log Indicators:

Unusual shell commands executed from Emacs process
File operations with metacharacters in names

Network Indicators:

Outbound connections from Emacs process to unexpected destinations

SIEM Query:

process.name:"emacs" AND cmdline:"sh" OR cmdline:"bash"

📊 Metadata

CVE ID: CVE-2023-28617

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-78

Published: March 19, 2023

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-28617, you might also want to check these: