CVE-2026-35571: medium-severity vulnerability in NationalSecurityAgency emissary
Emissary has Stored XSS via Navigation Template Link Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.8epss 0.2%
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected products
NationalSecurityAgency · emissaryRelated CVEs — NationalSecurityAgency emissary
In the same product, most dangerous first.
CVE-2021-32647HIGHPost-authentication Remote Code Execution (RCE) in emissary:emissaryEPSS 2.9%CVE-2021-32639HIGHServer-Side Request Forgery (SSRF) in emissary:emissaryEPSS 1.4%CVE-2021-32634HIGHDeserialization of Untrusted Data in EmissaryEPSS 1.3%CVE-2026-35582HIGHEmissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in ExecutrixEPSS 0.9%CVE-2026-35581HIGHEmissary has a Command Injection via PLACE_NAME Configuration in ExecutrixEPSS 0.6%CVE-2026-35580CRITICALEmissary has GitHub Actions Shell Injection via Workflow InputsEPSS 0.6%