Vulnerability Description
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nsa | Emissary | <= 8.38.0 |
Related Weaknesses (CWE)
References
- https://github.com/NationalSecurityAgency/emissary/pull/1293Patch
- https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-cpm7ExploitThird Party AdvisoryMitigation
FAQ
What is CVE-2026-35571?
CVE-2026-35571 is a vulnerability with a CVSS score of 4.8 (MEDIUM). Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme v...
How severe is CVE-2026-35571?
CVE-2026-35571 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-35571?
Check the references section above for vendor advisories and patch information. Affected products include: Nsa Emissary.