CVE-2026-35580

{
  "id": "CVE-2026-35580",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-07T17:16:33.307",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to repository poisoning and supply chain compromise affecting all downstream users. This vulnerability is fixed in 8.39.0."
    },
    {
      "lang": "es",
      "value": "Emissary es un motor de flujo de trabajo impulsado por datos basado en P2P. Antes de 8.39.0, los archivos de flujo de trabajo de GitHub Actions contenían puntos de inyección de shell donde las entradas “workflow_dispatch” controladas por el usuario se interpolaban directamente en comandos de shell a través de la sintaxis de expresión ${{ }}. Un atacante con acceso de escritura al repositorio podría inyectar comandos de shell arbitrarios, lo que lleva al envenenamiento del repositorio y al compromiso de la cadena de suministro que afecta a todos los usuarios posteriores. Esta vulnerabilidad está corregida en 8.39.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NationalSecurityAgency",
          "product": "emissary",
          "versions": [
            {
              "version": "< 8.39.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-07T18:25:08.739191Z",
          "id": "CVE-2026-35580",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nsa:emissary:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.10.0",
              "versionEndIncluding": "8.38.0",
              "matchCriteriaId": "63C8A099-EC01-496B-A224-0B1E8AA2A980"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/NationalSecurityAgency/emissary/pull/1286",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/NationalSecurityAgency/emissary/pull/1288",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-3g6g-gq4r-xjm9",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}