GNU Emacs before version 31.2, along with the TRAMP package up to 2.8.2, is vulnerable to OS command injection triggered by a specially crafted filename. The flaw stems from an incomplete list of disallowed input patterns in the tramp‑user‑regexp filter, enabling an attacker to inject and execute arbitrary commands when Emacs processes the file name. This results in remote code execution, compromising the confidentiality, integrity, and availability of the host system.

The affected products are GNU Emacs releases older than 31.2 and TRAMP libraries up to version 2.8.2. The vulnerability is present on all platforms supported by Emacs, as it involves filename handling rather than platform‑specific features. No further version narrowing is documented beyond the stated ranges.

The CVSS score of 7.8 indicates high severity, and although no EPSS score is available, the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed active exploitation. The flaw is exploitable through unsanitized filename handling; the likely attack vector involves supplying a malicious filename when opening files within Emacs, but the description does not explicitly state the interfaces, so this inference is derived from the generic file handling context.