Nationalsecurityagency Emissary vulnerabilities

CVE-2021-32647 [CRITICAL] CWE-74 CVE-2021-32647: Emissary is a P2P based data-driven workflow engine. Affected versions of Emissary are vulnerable to Emissary is a P2P based data-driven workflow engine. Affected versions of Emissary are vulnerable to post-authentication Remote Code Execution (RCE). The [`CreatePlace`](https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/CreatePlaceAction.java#L36) REST endpoin

CVE-2026-35580 [CRITICAL] CWE-77 CVE-2026-35580: Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to rep

CVE-2026-35582 [HIGH] CWE-78 CVE-2026-35582: Emissary is a P2P based data-driven workflow engine. In versions 8.42.0 and below, Executrix.getComm Emissary is a P2P based data-driven workflow engine. In versions 8.42.0 and below, Executrix.getCommand() is vulnerable to OS command injection because it interpolates temporary file paths into a /bin/sh -c shell command string without any escaping or input validation. The IN_FILE_ENDING and OUT_FILE_ENDING configuration keys flow directly into these p

CVE-2021-32639 [CRITICAL] CWE-918 CVE-2021-32639: Emissary is a P2P-based, data-driven workflow engine. Emissary version 6.4.0 is vulnerable to Server Emissary is a P2P-based, data-driven workflow engine. Emissary version 6.4.0 is vulnerable to Server-Side Request Forgery (SSRF). In particular, the `RegisterPeerAction` endpoint and the `AddChildDirectoryAction` endpoint are vulnerable to SSRF. This vulnerability may lead to credential leaks. Emissary version 7.0 contains a patch. As a workaround

CVE-2026-35581 [HIGH] CWE-78 CVE-2026-35581: Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Executrix utility class co Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Executrix utility class constructed shell commands by concatenating configuration-derived values — including the PLACE_NAME parameter — with insufficient sanitization. Only spaces were replaced with underscores, allowing shell metacharacters (;, |, $, `, (, ), etc.) to pass throu

CVE-2021-32634 [HIGH] CWE-502 CVE-2021-32634: Emissary is a distributed, peer-to-peer, data-driven workflow framework. Emissary 6.4.0 is vulnerabl Emissary is a distributed, peer-to-peer, data-driven workflow framework. Emissary 6.4.0 is vulnerable to Unsafe Deserialization of post-authenticated requests to the [`WorkSpaceClientEnqueue.action`](https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/WorkSpaceClie

CVE-2025-27508 [HIGH] CWE-327 CVE-2025-27508: Emissary is a P2P based data-driven workflow engine. The ChecksumCalculator class within allows for Emissary is a P2P based data-driven workflow engine. The ChecksumCalculator class within allows for hashing and checksum generation, but it includes or defaults to algorithms that are no longer recommended for secure cryptographic use cases (e.g., SHA-1, CRC32, and SSDEEP). These algorithms, while possibly valid for certain non-security-critical tasks,

CVE-2026-35583 [MEDIUM] CWE-22 CVE-2026-35583: Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the configuration API endpoint Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the configuration API endpoint (/api/configuration/{name}) validated configuration names using a blacklist approach that checked for \, /, .., and trailing .. This could potentially be bypassed using URL-encoded variants, double-encoding, or Unicode normalization to achieve path tr

CVE-2026-35571 [MEDIUM] CWE-79 CVE-2026-35571: Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against