A security vulnerability in GNU Emacs before version 29.1-12.oe2403sp4 allows OS command injection via a filename due to an incomplete list of disallowed inputs in tramp-user-regexp. This issue is a regression from an incomplete fix for a previous vulnerability (CVE-2026-79992).