CVE-2026-35581

Description

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Executrix utility class constructed shell commands by concatenating configuration-derived values — including the PLACE_NAME parameter — with insufficient sanitization. Only spaces were replaced with underscores, allowing shell metacharacters (;, |, $, `, (, ), etc.) to pass through into /bin/sh -c command execution. This vulnerability is fixed in 8.39.0.

PUBLISHED Reserved 2026-04-03 | Published 2026-04-07 | Updated 2026-04-08 | Assigner GitHub_M

Problem types

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

References

github.com/...issary/security/advisories/GHSA-6c37-7w4p-jg9v

cve.org (CVE-2026-35581)

nvd.nist.gov (CVE-2026-35581)

Download JSON