GNU Emacs before version 29.1-11.oe2403sp3 contains a security vulnerability allowing OS command injection via a filename due to an incomplete list of disallowed inputs in tramp-user-regexp. This issue is a regression related to an incomplete fix for a previous vulnerability (CVE-2026-79992).