3 ms·

The vulnerability is that Emacs evaluates this automatically: #+LINK: shell %(shell-command-to-string) [[shell:touch ~/hacked.txt]]

• deleted 2y ago
  [deleted]
• wiredfool 2y ago
  Is that only if the file has a specific extension? I'm not seeing it with a .txt extension.
  • accoil 2y ago
    You need to have OrgMode active, which is usually not enabled for .txt. Try .org as the extension, or run `M-x org-mode` after opening the file.