CVE-2026-35571

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35571", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-03T20:09:02.826Z", "datePublished": "2026-04-07T15:26:30.391Z", "dateUpdated": "2026-04-08T14:57:05.392Z"}, "containers": {"cna": {"title": "Emissary has Stored XSS via Navigation Template Link Injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-cpm7-cfpx-3hvp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-cpm7-cfpx-3hvp"}, {"name": "https://github.com/NationalSecurityAgency/emissary/pull/1293", "tags": ["x_refsource_MISC"], "url": "https://github.com/NationalSecurityAgency/emissary/pull/1293"}], "affected": [{"vendor": "NationalSecurityAgency", "product": "emissary", "versions": [{"version": "< 8.39.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T15:26:30.391Z"}, "descriptions": [{"lang": "en", "value": "Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0."}], "source": {"advisory": "GHSA-cpm7-cfpx-3hvp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T14:56:55.066521Z", "id": "CVE-2026-35571", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T14:57:05.392Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35571", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T14:56:55.066521Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T14:57:00.714Z"}}], "cna": {"title": "Emissary has Stored XSS via Navigation Template Link Injection", "source": {"advisory": "GHSA-cpm7-cfpx-3hvp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "NationalSecurityAgency", "product": "emissary", "versions": [{"status": "affected", "version": "< 8.39.0"}]}], "references": [{"url": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-cpm7-cfpx-3hvp", "name": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-cpm7-cfpx-3hvp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/NationalSecurityAgency/emissary/pull/1293", "name": "https://github.com/NationalSecurityAgency/emissary/pull/1293", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-07T15:26:30.391Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35571", "state": "PUBLISHED", "dateUpdated": "2026-04-08T14:57:05.392Z", "dateReserved": "2026-04-03T20:09:02.826Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-07T15:26:30.391Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "emissary", "vendor": "NationalSecurityAgency", "versions": [{"status": "affected", "version": "< 8.39.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nsa:emissary:*:*:*:*:*:*:*:*", "matchCriteriaId": "9EC86D6D-EB58-4DE4-B88C-C562B33281A0", "versionEndIncluding": "8.38.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0."}, {"lang": "es", "value": "Emissary es un motor de flujo de trabajo basado en P2P y dirigido por datos. Antes de la 8.39.0, las plantillas de navegaci\u00f3n de Mustache interpolaban valores de enlace controlados por configuraci\u00f3n directamente en los atributos href sin validaci\u00f3n del esquema de URL. Un administrador que pudiera modificar la configuraci\u00f3n de navItems podr\u00eda inyectar URIs de javascript_disabled: , lo que permit\u00eda cross-site scripting (XSS) almacenado contra otros usuarios autenticados que visualizaban la interfaz web de Emissary. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 8.39.0."}], "id": "CVE-2026-35571", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35571", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T14:56:55.066521Z", "version": "2.0.3"}}]}, "published": "2026-04-07T16:16:29.920", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/NationalSecurityAgency/emissary/pull/1293"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-cpm7-cfpx-3hvp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.39.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "emissary", "source": "cna", "vendor": "NationalSecurityAgency"}, "product": "emissary", "vendor": "nationalsecurityagency"}], "analysis": {"en": {"generated_at": "2026-04-07T22:10:02.844804+00:00", "value": {"mitigation_remediation": ["Upgrade Emissary to version 8.39.0 or later.", "Verify that navItems configuration can only be edited by trusted administrators.", "If an upgrade cannot be performed immediately, restrict administrator access to the navigation configuration until the patch is applied."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The flaw affects the National Security Agency\u2019s Emissary platform prior to version 8.39.0. Any deployment using an earlier version that permits administrators to edit navItems is vulnerable. The affected product is the Emissary P2P workflow engine.", "description_and_impact": "The vulnerability in the Emissary workflow engine allows an administrator with permission to modify the navigation configuration (navItems) to embed javascript: URLs directly into link href attributes. Because the engine inserts these values without validating the URL scheme, the stored link can trigger an XSS attack when other authenticated users view the web interface. Attacks can compromise user sessions, theft of credentials, or execution of malicious actions in the user\u2019s context.", "risk_and_exploitability": "The CVSS score of 4.8 indicates a moderate risk level. An attacker would need administrative access to modify the navigation configuration, and there is no evidence that this flaw is listed in the CISA Known Exploited Vulnerabilities catalog or that a public exploit is available. The attack requires an authenticated administrator, so the likelihood of exploitation is limited to organizations that grant such privileges. Nevertheless, successful exploitation could lead to significant damage to confidentiality, integrity, and availability of affected users\u2019 sessions."}}}}, "created": "2026-04-08T19:37:04.271142+00:00", "updated": "2026-04-08T19:48:13.367868+00:00", "vendors": ["nationalsecurityagency", "nationalsecurityagency$PRODUCT$emissary"]}