CVE-2026-35580

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-35580
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35580.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-35580
Aliases
Downstream
Related
Published
2026-04-07T15:55:56.074Z
Modified
2026-07-15T01:49:01.286215059Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Emissary has GitHub Actions Shell Injection via Workflow Inputs
Details

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to repository poisoning and supply chain compromise affecting all downstream users. This vulnerability is fixed in 8.39.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35580.json",
    "cwe_ids": [
        "CWE-77"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/nationalsecurityagency/emissary

Affected ranges

Type
GIT
Repo
https://github.com/nationalsecurityagency/emissary
Events
Introduced
48d1d04277e19635441a31006eb052a690afd7eb
Fixed
5e3d58513b4cc0362537c60f21983d62ddf40599
Database specific 
{
    "cpe": "cpe:2.3:a:nsa:emissary:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.39.0"
        },
        {
            "introduced": "5.10.0"
        },
        {
            "last_affected": "8.38.0"
        }
    ]
}

Affected versions

5.*
5.10.0
5.11.0
6.*
6.0.0
6.1.0
6.2.0
6.3.0
6.4.0
6.5.0
6.6.0
7.*
7.0.0
7.1.0
7.10.0
7.11.0
7.12.0
7.13.0
7.14.0
7.15.0
7.16.0
7.17.0
7.18.0
7.19.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.7.0
7.8.0
7.9.0
emissary-7.*
emissary-7.19.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35580.json"