CVE-2022-48339

An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a
command injection vulnerability. In the hfy-istext-command function, the
parameter file and parameter srcdir come from external input, and
parameters are not escaped. If a file name or directory name contains shell
metacharacters, code may be executed.

Bugs

• <https://debbugs.gnu.org/cgi/bugreport.cgi?bug=60295&gt;
• <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1031730&gt;