CVE-2026-35571 MEDIUM

CVE-2026-35571: Emissary has Stored XSS via Navigation Template Link Injection

Vendor Nationalsecurityagency
Product emissary
Weakness CWE-79 · XSS
Published April 7, 2026
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0.

Key dates

02Disclosure timeline

April 7, 2026 CVE published
April 8, 2026 Record updated