CVE-2026-35571

{
  "id": "CVE-2026-35571",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-07T16:16:29.920",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0."
    },
    {
      "lang": "es",
      "value": "Emissary es un motor de flujo de trabajo basado en P2P y dirigido por datos. Antes de la 8.39.0, las plantillas de navegación de Mustache interpolaban valores de enlace controlados por configuración directamente en los atributos href sin validación del esquema de URL. Un administrador que pudiera modificar la configuración de navItems podría inyectar URIs de javascript_disabled: , lo que permitía cross-site scripting (XSS) almacenado contra otros usuarios autenticados que visualizaban la interfaz web de Emissary. Esta vulnerabilidad está corregida en la versión 8.39.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NationalSecurityAgency",
          "product": "emissary",
          "versions": [
            {
              "version": "< 8.39.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-08T14:56:55.066521Z",
          "id": "CVE-2026-35571",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nsa:emissary:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "8.38.0",
              "matchCriteriaId": "9EC86D6D-EB58-4DE4-B88C-C562B33281A0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/NationalSecurityAgency/emissary/pull/1293",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-cpm7-cfpx-3hvp",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ]
    }
  ]
}