Vulnerabilities

TI-2026-27685 CVE-2026-35582 · GHSA-3p24-9x7v-7789

Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix

HIGH 73

Emissary is a P2P based data-driven workflow engine.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00861 Published 2026-04-18 Fixed in 8.43.0 CWE-116

TI-2026-27686 CVE-2026-35583 · GHSA-hxf2-gm22-7vcm

Emissary has a Path Traversal via Blacklist Bypass in Configuration API

LOW 30

Emissary is a P2P based data-driven workflow engine.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00333 Published 2026-04-07 Fixed in 8.39.0 CWE-22

TI-2026-27684 CVE-2026-35581 · GHSA-6c37-7w4p-jg9v

Emissary has a Command Injection via PLACE_NAME Configuration in Executrix

LOW 34

Emissary is a P2P based data-driven workflow engine.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00585 Published 2026-04-07 Fixed in 8.39.0 CWE-78

TI-2026-27683 CVE-2026-35580 · GHSA-3g6g-gq4r-xjm9

Emissary has GitHub Actions Shell Injection via Workflow Inputs

MEDIUM 42

Emissary is a P2P based data-driven workflow engine.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00576 Published 2026-04-07 Fixed in 8.39.0 CWE-77

TI-2026-27675 CVE-2026-35571 · GHSA-cpm7-cfpx-3hvp

Emissary has Stored XSS via Navigation Template Link Injection

LOW 21

Emissary is a P2P based data-driven workflow engine.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00182 Published 2026-04-07 Fixed in 8.39.0 CWE-79

TI-2021-12307 CVE-2021-32639

Server-Side Request Forgery (SSRF) in emissary:emissary

MEDIUM 45

Emissary is a P2P-based, data-driven workflow engine.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01395 Published 2021-07-02 No fix listed CWE-918

TI-2021-12315 CVE-2021-32647

Post-authentication Remote Code Execution (RCE) in emissary:emissary

MEDIUM 45

Emissary is a P2P based data-driven workflow engine.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.0285 Published 2021-05-28 No fix listed CWE-74

TI-2021-12303 CVE-2021-32634

Deserialization of Untrusted Data in Emissary

LOW 34

Emissary is a distributed, peer-to-peer, data-driven workflow framework.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01276 Published 2021-05-21 Fixed in 6.5.0 CWE-502

TI-2021-12045 CVE-2021-32092 · GHSA-c8p5-2vx8-4c5h

A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S.

LOW 29

A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00955 Published 2021-05-07 No fix listed CWE-79

TI-2021-12046 CVE-2021-32093 · GHSA-fqvq-c37v-p4xx

The ConfigFileAction component of U.S.

LOW 31

The ConfigFileAction component of U.S.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01019 Published 2021-05-07 No fix listed CWE-862

TI-2021-12047 CVE-2021-32094 · GHSA-4c4c-c4fg-2wpp

U.S.

MEDIUM 40

U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01185 Published 2021-05-07 No fix listed CWE-434

TI-2021-12048 CVE-2021-32095 · GHSA-9894-h296-27h4

U.S.

LOW 37

U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00891 Published 2021-05-07 No fix listed CWE-862

TI-2021-12049 CVE-2021-32096 · GHSA-8pp7-v75p-mx4p

The ConsoleAction component of U.S.

LOW 39

The ConsoleAction component of U.S.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00592 Published 2021-05-07 No fix listed CWE-352

Vulnerabilities

Filters