Hi, In ctags (Emacs &lt;= 28.2.50) has a command execute vulnerability.<div><br></div><div>When using the -u parameter, ctags will execute external shell commands by calling the system() function, if there are special file names, unexpected shell commands may be executed. The example is as follows:</div><div><br></div><div><div>$ ls</div><div>etags.c</div></div><div>$ /usr/local/bin/ctags *.c</div><div><div>$ touch "'| uname -a #.c"</div><div>$ /usr/local/bin/ctags -u *.c</div><div>Linux mypc 6.0.8-300.fc37.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Nov 11 15:09:04 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux</div><div><br></div><div>^C/usr/local/bin/ctags: failed to execute shell command</div><div><br></div><div>The vulnerability occurs in the following code:</div><div><br></div><div><div>char *z = stpcpy (cmd, "mv ");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</div><div>z = stpcpy (z, tagfile);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</div><div>z = stpcpy (z, " OTAGS;grep -Fv '\t");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</div><div>z = stpcpy (z, argbuffer[i].what);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</div><div>z = stpcpy (z, "\t' OTAGS &gt;");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</div><div>z = stpcpy (z, tagfile);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</div><div>strcpy (z, ";rm OTAGS");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;</div><div>if (system (cmd) != EXIT_SUCCESS)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </div><div>&nbsp; fatal ("failed to execute shell command");&nbsp; &nbsp; &nbsp;</div></div><div><br></div><div>Because the file name is not checked, the file name is used as a concatenated string:</div><div><br></div><div>mv tags OTAGS;grep -Fv '<span style="white-space:pre">	</span>'| uname -a #.c<span style="white-space:pre">	</span>' OTAGS &gt;tags;rm OTAGS</div><div><br></div><div>Email attachments are patches.</div><div><br></div></div>