{"id":"AZL-107949","summary":"CVE-2026-108976 affecting package emacs 29.4-6","details":"GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.","modified":"2026-10-13T05:35:23Z","published":"2026-10-11T21:16:43Z","upstream":["CVE-2026-108976"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108976"}],"affected":[{"package":{"name":"emacs","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/emacs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"29.4-6"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-107949.json"}}],"schema_version":"1.9.0"}