Hi, On Wed, Oct 14, 2026 at 10:17:08AM +0100, Sam James wrote: > Sean Whitton <[email protected]> writes: > > > Wonyoung Jung of 78ResearchLab, using their PatchHawk tool, discovered > > that the fix for CVE-2026-79992 was incomplete. > > The tramp-user-regexp failed to check for some additional problematic > > characters in user names, meaning that exploitation was still possible. > > > > The attached patch by TRAMP maintainer Michael Albinus addresses the > > problem. It will be included in Emacs 31.2 though that won't be > > released soon. > > > > Red Hat, would you be willing to provide another CVE for this? Thank > you.
FWIW, this is already https://www.cve.org/CVERecord?id=CVE-2026-108976 . Regards, Salvatore
