CVE-2026-35582

{
  "id": "CVE-2026-35582",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-18T02:16:11.510",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Emissary is a P2P based data-driven workflow engine. In versions 8.42.0 and below, Executrix.getCommand() is vulnerable to OS command injection  because it interpolates temporary file paths into a /bin/sh -c shell command string without any escaping or input validation. The IN_FILE_ENDING and OUT_FILE_ENDING configuration keys flow directly into these paths, allowing a place author who can write or modify a .cfg file to inject arbitrary shell metacharacters that execute OS commands in the JVM process's security context. The framework already sanitizes placeName via an allowlist before embedding it in the same shell string, but applies no equivalent sanitization to file ending values. No runtime privileges beyond place configuration authorship, and no API or network access, are required to exploit this vulnerability. This is a framework-level defect with no safe mitigation available to downstream implementors, as Executrix provides neither escaping nor documented preconditions against metacharacters in file ending inputs. This issue has been fixed in version 8.43.0."
    },
    {
      "lang": "es",
      "value": "Emissary es un motor de flujo de trabajo basado en P2P y dirigido por datos. En las versiones 8.42.0 e inferiores, Executrix.getCommand() es vulnerable a la inyección de comandos del sistema operativo porque interpola rutas de archivos temporales en una cadena de comandos de shell /bin/sh -c sin ningún escape o validación de entrada. Las claves de configuración IN_FILE_ENDING y OUT_FILE_ENDING fluyen directamente a estas rutas, permitiendo que un autor de lugar que pueda escribir o modificar un archivo .cfg inyecte metacaracteres de shell arbitrarios que ejecuten comandos del sistema operativo en el contexto de seguridad del proceso JVM. El framework ya sanea placeName a través de una lista de permitidos antes de incrustarlo en la misma cadena de shell, pero no aplica ninguna sanitización equivalente a los valores de terminación de archivo. No se requieren privilegios de tiempo de ejecución más allá de la autoría de la configuración del lugar, ni acceso a la API o a la red, para explotar esta vulnerabilidad. Este es un defecto a nivel de framework sin mitigación segura disponible para los implementadores posteriores, ya que Executrix no proporciona ni escape ni precondiciones documentadas contra metacaracteres en las entradas de terminación de archivo. Este problema ha sido solucionado en la versión 8.43.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "NationalSecurityAgency",
          "product": "emissary",
          "versions": [
            {
              "version": "< 8.43.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-20T15:48:23.954422Z",
          "id": "CVE-2026-35582",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        },
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nsa:emissary:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "8.43.0",
              "matchCriteriaId": "E8B2D162-B83D-4E41-A44D-616C0177B7D1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/NationalSecurityAgency/emissary/commit/1faf33f2494c0128f250d7d2e8f2da99bbd32ae8",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-3p24-9x7v-7789",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}