Emacs upstream reports:

Bas Alberts of the GitHub Security Lab discovered that the fix for
CVE-2024-53920, an arbitrary code execution flaw in Emacs, was
incomplete.  Viewing or editing untrusted text files in modes other than
Emacs Lisp mode can also permit arbitrary code execution.  For example:

    #!/usr/bin/perl
    # -*- mode: perl; mode: flymake -*-
    BEGIN { system("touch uh_oh.txt"); }

This problem affects all Emacs versions affected by CVE-2024-53920.
This means Emacs 24 and newer, and possibly also older versions.

A minimal fix, attached, is queued up for release with Emacs 31.2.
We (the Emacs upstream maintainers) don't expect to backport the fix to
older Emacs releases ourselves.

Source:
https://www.openwall.com/lists/oss-security/2026/09/14/1

Upstream commit - emacs-31 branch:
https://github.com/emacs-mirror/emacs/commit/abc802ee2eb0b1663349ddf22a461f8e54a383fb

Upstream commit - master branch:
https://github.com/emacs-mirror/emacs/commit/135e6f63f08fee3d374fa1a5187bce941a2d3e3c