CVE-2024-53920 Emacs arbitrary code execution via unsafe macro-expansion

[Eshel Yaron]

Hi all,

I've just published an advisory regarding an arbitrary code execution
vulnerability in Emacs, which has been assigned CVE-2024-53920:

https://eshelyaron.com/posts/2024-11-27-emacs-aritrary-code-execution-and-how-to-avoid-it.html

The vulnerability itself is not new and it has been brought up in the
past (as I learned from Stefan K. after reporting this issue privately),
but no CVE has been assigned previously.  I tried to spell out the issue
in clear and simple terms in this advisory, if someone spots a mistake
or something that deserves further clarification, please let me know.


Best regards and safe hacking,

Eshel