Emissary vulnerabilities

Emissary versions 8.42.0 and below contain an OS command injection vulnerability in Executrix.getCommand() because temporary file paths are interpolated into a /bin/sh -c shell command string without escaping. The IN_FILE_ENDING and OUT_FILE_ENDING configuration keys flow directly into these paths, allowing a place author who can edit a .cfg file to inject shell metacharacters and execute commands in the JVM process's security context.

Emissary before 8.39.0 validates configuration names in the /api/configuration/{name} endpoint using a blacklist checking for \, /, .., and trailing ... This can be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path traversal and read configuration files outside the intended directory. Fixed in 8.39.0.

Emissary prior to 8.39.0 interpolated configuration-controlled link values directly into href attributes in Mustache navigation templates without URL scheme validation. An administrator able to modify the navItems configuration could inject javascript: URIs, enabling stored XSS against other authenticated users viewing the Emissary web interface.