PT-2026-30893 · Emissary · Emissary

Brennantm · Published 2026-04-07 · Updated 2026-04-08 · CVE-2026-35581

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Emissary versions prior to 8.39.0

Description Emissary is a P2P based data-driven workflow engine. Prior to version 8.39.0, the Executrix utility class constructed shell commands by concatenating configuration-derived values, including the PLACE NAME parameter, with insufficient sanitization. Only spaces were replaced with underscores, allowing shell metacharacters such as ;, |, $, `, (, ), etc., to pass through into /bin/sh -c command execution.

Recommendations Update to version 8.39.0 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-35581

GHSA-6C37-7W4P-JG9V

Affected Products

Emissary

References · 8

• https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-6c37-7w4p-jg9v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35581 · Security Note
• https://osv.dev/vulnerability/GHSA-6c37-7w4p-jg9v · Vendor Advisory
• https://github.com/NationalSecurityAgency/emissary · Note
• https://github.com/NationalSecurityAgency/emissary/pull/1290 · Note
• https://twitter.com/infoflowcloud/status/2041570792236790139 · Twitter Post
• https://twitter.com/CVEnew/status/2041570005243044172 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1sft88v/resumen_diario_de_vulnerabilidades_08042026 · Reddit Post