TI-2026-27683 Aliases CVE-2026-35580 GHSA-3g6g-gq4r-xjm9

Emissary has GitHub Actions Shell Injection via Workflow Inputs

MEDIUM 42CWE-77Published 2026-04-07 · Updated 2026-04-07

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to repository poisoning and supply chain compromise affecting all downstream users. This vulnerability is fixed in 8.39.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00576 47th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed emissary (NationalSecurityAgency): 8.39.0gov.nsa.emissary:emissary (Maven): 8.39.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NationalSecurityAgency	emissary	before 8.39.0	8.39.0	Patch available	CNA
—	gov.nsa.emissary:emissary (Maven)	before 8.39.0	8.39.0	Patch available	GHSA-3g6g-gq4r-xjm9

emissary VendorNationalSecurityAgency Affected before 8.39.0 Fixed in 8.39.0 Patch available CNA
gov.nsa.emissary:emissary (Maven) Vendor— Affected before 8.39.0 Fixed in 8.39.0 Patch available GHSA-3g6g-gq4r-xjm9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nsa:emissary::::::::	5.10.0 – 8.38.0	Vulnerable	NationalSecurityAgency

cpe:2.3:a:nsa:emissary:*:*:*:*:*:*:*:* Versions 5.10.0 – 8.38.0 Vulnerable ·NationalSecurityAgency

Remediation

Fix · CNA emissary (NationalSecurityAgency) Fixed in 8.39.0
Fix · GHSA-3g6g-gq4r-xjm9 gov.nsa.emissary:emissary (Maven) Fixed in 8.39.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-35580
2026-10-03 Alias added: GHSA-3g6g-gq4r-xjm9
2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-3g6g-gq4r-xjm9

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-35580

Other 1

https://github.com/NationalSecurityAgency/emissary

TI-2026-27685 Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix CVSS 3.1HIGH 8.8
TI-2021-12315 Post-authentication Remote Code Execution (RCE) in emissary:emissary CVSS 3.1CRITICAL 9.1
TI-2021-12307 Server-Side Request Forgery (SSRF) in emissary:emissary CVSS 3.1CRITICAL 9.9
TI-2021-12047 U.S. CVSS 3.1HIGH 8.8
TI-2021-12049 The ConsoleAction component of U.S. CVSS 3.1HIGH 8.8
TI-2021-12048 U.S. CVSS 3.1HIGH 8.1

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences