CVE-2026-35581

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Executrix utility class constructed shell commands by concatenating configuration-derived values — including the PLACE_NAME parameter — with insufficient sanitization. Only spaces were replaced with underscores, allowing shell metacharacters (;, |, $, `, (, ), etc.) to pass through into /bin/sh -c command execution. This vulnerability is fixed in 8.39.0.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-6c37-7w4p-jg9v	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nsa:emissary:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Emissary es un motor de flujo de trabajo impulsado por datos basado en P2P. Antes de la versión 8.39.0, la clase de utilidad Executrix construía comandos de shell concatenando valores derivados de la configuración - incluyendo el parámetro PLACE_NAME - con sanitización insuficiente. Solo los espacios eran reemplazados por guiones bajos, permitiendo que los metacaracteres de shell (;, \|, $, ”, (, ), etc.) pasaran a la ejecución de comandos de /bin/sh -c. Esta vulnerabilidad está corregida en la versión 8.39.0.

Information

Published : 2026-04-07 17:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-35581

Mitre link : CVE-2026-35581

CVE.ORG link : CVE-2026-35581

JSON object : View

Products Affected

nsa

emissary

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-35581", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35581", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-08T14:57:38.566917Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "NationalSecurityAgency", "product": "emissary", "versions": [{"status": "affected", "version": "< 8.39.0"}]}]}], "published": "2026-04-07T17:16:33.493", "references": [{"url": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-6c37-7w4p-jg9v", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Executrix utility class constructed shell commands by concatenating configuration-derived values \u2014 including the PLACE_NAME parameter \u2014 with insufficient sanitization. Only spaces were replaced with underscores, allowing shell metacharacters (;, |, $, `, (, ), etc.) to pass through into /bin/sh -c command execution. This vulnerability is fixed in 8.39.0."}, {"lang": "es", "value": "Emissary es un motor de flujo de trabajo impulsado por datos basado en P2P. Antes de la versi\u00f3n 8.39.0, la clase de utilidad Executrix constru\u00eda comandos de shell concatenando valores derivados de la configuraci\u00f3n - incluyendo el par\u00e1metro PLACE_NAME - con sanitizaci\u00f3n insuficiente. Solo los espacios eran reemplazados por guiones bajos, permitiendo que los metacaracteres de shell (;, |, $, \u201d, (, ), etc.) pasaran a la ejecuci\u00f3n de comandos de /bin/sh -c. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 8.39.0."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nsa:emissary:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EC86D6D-EB58-4DE4-B88C-C562B33281A0", "versionEndIncluding": "8.38.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}