| Package | Affected versions | Patched versions |
|---|---|---|
| emacs | < 29.4 | 29.4 |
In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free