# Emacs .dir-locals.el arbitrary code execution

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/656) · 2026-11-11 · Security
Page: https://themorning.dev/story/emacs-dir-locals-el-arbitrary-code-execution-2b4a4d11727a07e8
Kind: security · Impact: high

## In brief

- Emacs 31.1 did not adequately validate the contents of .dir-locals.el before executing code from it, allowing arbitrary code execution.
- Emacs 30.2 is unaffected.
- A patch from Stefan Monnier is attached to the disclosure and will be included in the upcoming Emacs 31.2 release.

## Why it matters

Opening a project containing a malicious .dir-locals.el file could run attacker-chosen code on a developer's machine when using Emacs 31.1.

## What to do

- Stay on or fall back to Emacs 30.2, which is unaffected, until Emacs 31.2 is released.
- Apply the patch from Stefan Monnier attached to the disclosure, or upgrade to Emacs 31.2 once it ships.

## Versions

- Emacs 31.1
- Emacs 30.2
- Emacs 31.2

## Timeline

- 2026-11-11: Vulnerability disclosed on the oss-security list by Sean Whitton

## Coverage

- [Emacs .dir-locals.el arbitrary code execution](https://seclists.org/oss-sec/2026/q4/656) — Open Source Security, 2026-11-11

Tags: emacs, security, arbitrary-code-execution, dir-locals, vulnerability

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev