# CVE-2026-35571: Emissary has Stored XSS via Navigation Template Link Injection

Source: https://junglewise.ai/threats/cve-2026-35571-emissary-has-stored-xss-via-navigation-template-link-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07  
License: CC BY 4.0 with a link back

CVE-2026-35571 · Severity: medium · CVSS 4.8 · Published 2026-04-07

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0.

Technologies: [gov.nsa.emissary:emissary (Maven)](https://junglewise.ai/threats/technologies/gov-nsa-emissary-emissary), [Nsa Emissary](https://junglewise.ai/threats/technologies/emissary). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Nsa](https://junglewise.ai/threats/vendors/nsa).

## Quick answers

**Is CVE-2026-35571 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35571 being exploited in the wild.

**How severe is CVE-2026-35571?** Medium severity, with a CVSS score of 4.8, published 7 April 2026.

**Which products and versions are affected?** gov.nsa.emissary:emissary (Maven) <= 8.38.0, ECOSYSTEM:introduced=0,fixed=8.39.0.

**Is there a fix for CVE-2026-35571?** Yes. gov.nsa.emissary:emissary (Maven): upgrade to 8.39.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-35571?** Check whether you run gov.nsa.emissary:emissary (Maven) or Nsa Emissary at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- gov.nsa.emissary:emissary (Maven): upgrade to 8.39.0 or later

  ```sh
  # set gov.nsa.emissary:emissary to 8.39.0 in your pom.xml or build.gradle
  ```


## Affected products

- gov.nsa.emissary:emissary (Maven) <= 8.38.0, ECOSYSTEM:introduced=0,fixed=8.39.0
- Nsa Emissary

## Identifiers

- CVE-2026-35571
- GHSA-cpm7-cfpx-3hvp

## Related threats

- [NationalSecurityAgency Emissary incomplete SSRF/redirect fix](https://junglewise.ai/threats/cve-2026-54442-nationalsecurityagency-emissary-has-an-incomplete-fix-for)
- [Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix](https://junglewise.ai/threats/cve-2026-35582-emissary-has-an-os-command-injection-via-unvalidated-in-file)
- [Emissary has a Path Traversal via Blacklist Bypass in Configuration API](https://junglewise.ai/threats/cve-2026-35583-emissary-has-a-path-traversal-via-blacklist-bypass-in)
- [Emissary has a Command Injection via PLACE_NAME Configuration in Executrix](https://junglewise.ai/threats/cve-2026-35581-emissary-has-a-command-injection-via-place-name-configuration-in)
- [Emissary has GitHub Actions Shell Injection via Workflow Inputs](https://junglewise.ai/threats/cve-2026-35580-emissary-has-github-actions-shell-injection-via-workflow-inputs)