PT-2026-30892 · Emissary · Emissary

Brennantm · Published 2026-04-06 · Updated 2026-04-14 · CVE-2026-35580

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Emissary versions prior to 8.39.0

Description Emissary is a P2P based data-driven workflow engine. Prior to version 8.39.0, GitHub Actions workflow files contained shell injection points. User-controlled workflow dispatch inputs were interpolated directly into shell commands via the ${{ }} expression syntax. An attacker with repository write access could inject arbitrary shell commands, potentially leading to repository poisoning and supply chain compromise affecting downstream users.

Recommendations Update to version 8.39.0 or higher.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-35580

GHSA-3G6G-GQ4R-XJM9

OPENSUSE-SU-2026:10540-1

Affected Products

Emissary

References · 19

• https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-3g6g-gq4r-xjm9 · Vendor Advisory
• https://github.com/NationalSecurityAgency/emissary/pull/1286 · Patch
• https://github.com/NationalSecurityAgency/emissary/pull/1288 · Patch
• https://cve.org/CVERecord?id=CVE-2026-35580 · Security Note
• https://osv.dev/vulnerability/GHSA-3g6g-gq4r-xjm9 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-35580 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10540-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35580 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35580 · Security Note
• https://github.com/randombit/botan/pull/5500 · Note
• https://github.com/NationalSecurityAgency/emissary · Note
• https://twitter.com/CVEnew/status/2041570007050822098 · Twitter Post
• https://twitter.com/pulsepatchio/status/2042072730217148490 · Twitter Post
• https://twitter.com/CveFindCom/status/2041572535867789658 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041570809529929964 · Twitter Post