CVE-2026-35581 Details
Description
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Executrix utility class constructed shell commands by concatenating configuration-derived values — including the PLACE_NAME parameter — with insufficient sanitization. Only spaces were replaced with underscores, allowing shell metacharacters (;, |, $, `, (, ), etc.) to pass through into /bin/sh -c command execution. This vulnerability is fixed in 8.39.0.
A command injection vulnerability has been identified in the Emissary workflow engine, specifically in versions through 8.38.0. The issue arises in the Executrix utility class, which improperly sanitizes shell command inputs derived from configuration values, including the PLACE_NAME parameter. This inadequate sanitization allowed shell metacharacters to be executed via /bin/sh -c, potentially leading to arbitrary command execution on the host. The vulnerability requires control over configuration values, such as administrative access or a compromised configuration source.
This vulnerability has been fixed in Emissary version 8.39.0. Users unable to upgrade should ensure that PLACE_NAME values in all configuration files contain only alphanumeric characters, underscores, and hyphens.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-6c37-7w4p-jg9v | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nsa emissary | <= 8.38.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | New CVE Received | [email protected] |