Emacs .dir-locals.el arbitrary code execution

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Emacs 31.1 users opening projects with malicious .dir-locals.el files

Tier B because: Full takeover OR secrets exposed OR supply chain

Reach

Attack

Damage

Fix

Popular tool · Full takeover · No fix yet

What to do

Stay on or fall back to Emacs 30.2, which is unaffected, until Emacs 31.2 is released.
Apply the patch from Stefan Monnier attached to the disclosure, or upgrade to Emacs 31.2 once it ships.

The Brief

Emacs 31.1 did not adequately validate the contents of .dir-locals.el before executing code from it, allowing arbitrary code execution.
Emacs 30.2 is unaffected.
A patch from Stefan Monnier is attached to the disclosure and will be included in the upcoming Emacs 31.2 release.

Opening a project containing a malicious .dir-locals.el file could run attacker-chosen code on a developer's machine when using Emacs 31.1.

Checklist · 4 of 10 yes

Yes	Hits tech teams	Judgment: Emacs is a developer text editor used by programmers to edit code.
No	Core infrastructure	Judgment: a single editor, not infrastructure that nearly every team runs.
Yes	Popular tool	Judgment: Emacs is a widely used developer editor with a large user base.
No	Exploited in the wild	Open Source Security: a researcher discovered the flaw; no observed attacks are reported.
No	Public exploit	Open Source Security: only discovery and a patch are mentioned; no public exploit or PoC is reported.
No	Remote, no login	Open Source Security: flaw is in .dir-locals.el handling; no unauthenticated network attack is described.
Yes	Full takeover	Open Source Security: the flaw is described as arbitrary code execution.
No	Secrets exposed	Open Source Security: no theft or exposure of credentials, tokens, or data is reported.
No	Supply chain	Open Source Security: a flaw in code validation; no compromised package, update, or pipeline is reported.
Yes	No fix yet	Open Source Security: a patch is attached and will be included in the upcoming 31.2 release, so no fixed release yet.

Nov 11
Vulnerability disclosed on the oss-security list by Sean Whitton
Nov 11 · 4:14 PM
Open Source Security
Emacs .dir-locals.el arbitrary code execution

First seen 2h ago · 1 source · Full story page · How tiers are decided