CVE-2026-79992: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Red Hat Red Hat Enterprise Linux 10

A flaw in Emacs TRAMP on Red Hat Enterprise Linux 10 allows local attackers to execute arbitrary OS commands due to improper neutralization of special elements in login arguments. TRAMP concatenates these arguments without proper sanitization before passing them to a local shell. An attacker with local access can exploit this by tricking a user into processing a maliciously crafted filename, leading to arbitrary code execution. The vulnerability is classified as CWE-78 (OS Command Injection) and has a CVSS v3.1 score of 7.8 (High).

Successful exploitation can lead to arbitrary code execution with high impact on confidentiality, integrity, and availability. Attackers could execute unauthorized commands, potentially disabling the product, reading or modifying data without permission, or hiding malicious activities under the application's identity. However, exploitation requires local access and user interaction with a malicious file, limiting remote attack vectors.

Red Hat advises users to avoid processing untrusted filenames or interacting with remote systems that may contain maliciously crafted filenames. This operational control reduces the risk of local shell command injection. No official patch or fix status is provided in the advisory; therefore, patch status is not yet confirmed — check the Red Hat advisory for current remediation guidance.