GNU Emacs versions before 29.1-11.oe2403sp1 contain a security vulnerability (CVE-2026-108976) that allows OS command injection via a filename. This occurs because the tramp-user-regexp filter has an incomplete list of disallowed inputs, resulting from an incomplete fix of a previous vulnerability (CVE-2026-79992).