CVE-2026-35571

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/NationalSecurityAgency/emissary/pull/1293	Patch
https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-cpm7-cfpx-3hvp	Exploit Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nsa:emissary:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Emissary es un motor de flujo de trabajo basado en P2P y dirigido por datos. Antes de la 8.39.0, las plantillas de navegación de Mustache interpolaban valores de enlace controlados por configuración directamente en los atributos href sin validación del esquema de URL. Un administrador que pudiera modificar la configuración de navItems podría inyectar URIs de javascript_disabled: , lo que permitía cross-site scripting (XSS) almacenado contra otros usuarios autenticados que visualizaban la interfaz web de Emissary. Esta vulnerabilidad está corregida en la versión 8.39.0.

Information

Published : 2026-04-07 16:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-35571

Mitre link : CVE-2026-35571

CVE.ORG link : CVE-2026-35571

JSON object : View

Products Affected

nsa

emissary

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-35571", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35571", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T14:56:55.066521Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "NationalSecurityAgency", "product": "emissary", "versions": [{"status": "affected", "version": "< 8.39.0"}]}]}], "published": "2026-04-07T16:16:29.920", "references": [{"url": "https://github.com/NationalSecurityAgency/emissary/pull/1293", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-cpm7-cfpx-3hvp", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0."}, {"lang": "es", "value": "Emissary es un motor de flujo de trabajo basado en P2P y dirigido por datos. Antes de la 8.39.0, las plantillas de navegaci\u00f3n de Mustache interpolaban valores de enlace controlados por configuraci\u00f3n directamente en los atributos href sin validaci\u00f3n del esquema de URL. Un administrador que pudiera modificar la configuraci\u00f3n de navItems podr\u00eda inyectar URIs de javascript_disabled: , lo que permit\u00eda cross-site scripting (XSS) almacenado contra otros usuarios autenticados que visualizaban la interfaz web de Emissary. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 8.39.0."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nsa:emissary:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EC86D6D-EB58-4DE4-B88C-C562B33281A0", "versionEndIncluding": "8.38.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}