CVE-2026-35581

{
  "id": "CVE-2026-35581",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-07T17:16:33.493",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Executrix utility class constructed shell commands by concatenating configuration-derived values — including the PLACE_NAME parameter — with insufficient sanitization. Only spaces were replaced with underscores, allowing shell metacharacters (;, |, $, `, (, ), etc.) to pass through into /bin/sh -c command execution. This vulnerability is fixed in 8.39.0."
    },
    {
      "lang": "es",
      "value": "Emissary es un motor de flujo de trabajo impulsado por datos basado en P2P. Antes de la versión 8.39.0, la clase de utilidad Executrix construía comandos de shell concatenando valores derivados de la configuración - incluyendo el parámetro PLACE_NAME - con sanitización insuficiente. Solo los espacios eran reemplazados por guiones bajos, permitiendo que los metacaracteres de shell (;, |, $, ”, (, ), etc.) pasaran a la ejecución de comandos de /bin/sh -c. Esta vulnerabilidad está corregida en la versión 8.39.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NationalSecurityAgency",
          "product": "emissary",
          "versions": [
            {
              "version": "< 8.39.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-08T14:57:38.566917Z",
          "id": "CVE-2026-35581",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nsa:emissary:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "8.38.0",
              "matchCriteriaId": "9EC86D6D-EB58-4DE4-B88C-C562B33281A0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-6c37-7w4p-jg9v",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}