CVE-2026-35580
Emissary has GitHub Actions Shell Injection via Workflow Inputs
Reported by github_m · Published April 7, 2026
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to repository poisoning and supply chain compromise affecting all downstream users. This vulnerability is fixed in 8.39.0.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| emissary | nsa | 8.38.0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| NationalSecurityAgency | emissary | < 8.39.0 |
| NationalSecurityAgency | emissary | 0 |
| Maven | gov.nsa.emissary:emissary | 0 |
Timeline
- Apr 7, 2026 CVE Published
- May 18, 2026 EPSS Score (30 in total, the first dated here)
- Jun 1, 2026 Security Advisory
- Jun 21, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-35580
vulnetix vdb fixes CVE-2026-35580Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-35580/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-3g6g-gq4r-xjm9 x_refsource_CONFIRM
- https://github.com/NationalSecurityAgency/emissary/pull/1286 x_refsource_MISC
- https://github.com/NationalSecurityAgency/emissary/pull/1288 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-35580 advisory
- https://github.com/advisories/GHSA-3g6g-gq4r-xjm9 advisory
- https://github.com/NationalSecurityAgency/emissary url