CVE-2026-35571
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Emissary prior to 8.39.0 interpolated configuration-controlled link values directly into href attributes in Mustache navigation templates without URL scheme validation. An administrator able to modify the navItems configuration could inject javascript: URIs, enabling stored XSS against other authenticated users viewing the Emissary web interface.
Risk Assessment
Authenticated users visiting the Emissary interface could be victims of malicious script execution in their context. Exploitation requires administrative privileges to modify configuration.
Recommendation
Update Emissary to version 8.39.0 or later. Restrict permissions to edit navigation configuration to trusted administrators.
Other vulnerabilities in Emissary
See all- CVE-2026-35582High
Emissary versions 8.42.0 and below contain an OS command injection vulnerability in Executrix.getCommand() because temporary file paths are interpolated into a /bin/sh -c shell command string without escaping. The IN_FILE_ENDING and OUT_FILE_ENDING configuration keys flow directly into these paths, allowing a place author who can edit a .cfg file to inject shell metacharacters and execute commands in the JVM process's security context.
- CVE-2026-35583Medium
Emissary before 8.39.0 validates configuration names in the /api/configuration/{name} endpoint using a blacklist checking for \, /, .., and trailing ... This can be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path traversal and read configuration files outside the intended directory. Fixed in 8.39.0.
Original NVD description (English source)
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS