Executive brief
Emissary has GitHub Actions Shell Injection via Workflow Inputs
Affected products
- Maven gov.nsa.emissary:emissary
Junglewise Threat Intelligence
CVE-2026-35580: Emissary has GitHub Actions Shell Injection via Workflow Inputs
CVE-2026-35580 · Severity: low · CVSS 3.1 · Published 2026-04-08
Technologies: gov.nsa.emissary:emissary (Maven). Vendors: Maven.
Related threats
- Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
- Emissary has a Path Traversal via Blacklist Bypass in Configuration API
- Emissary has a Command Injection via PLACE_NAME Configuration in Executrix
- Emissary has Stored XSS via Navigation Template Link Injection
- Emissary May Use a Broken or Risky Cryptographic Algorithm