medium4.8
CVE-2026-35571
Emissary has Stored XSS via Navigation Template Link Injection
Impact
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | gov.nsa.emissary:emissary | <= 8.38.0 | 8.39.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nsa | Emissary | through 8.38.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/NationalSecurityAgency/emissary/pull/1293
- https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-cpm7-cfpx-3hvp
- https://github.com/advisories/GHSA-cpm7-cfpx-3hvp
- https://nvd.nist.gov/vuln/detail/CVE-2026-35571
- https://github.com/NationalSecurityAgency/emissary/commit/e2078417464b9004620dde28dcbca2f73ea06c13