CVE-2026-35580 - Vulnerability Analysis

Overview

Emissary < 8.39.0 contains a command injection caused by interpolation of user-controlled workflow_dispatch inputs into shell commands via ${{ }} syntax, letting attackers with repository write access execute arbitrary shell commands.

Severity & Score

Impact

Attackers with repository write access can execute arbitrary shell commands, leading to repository poisoning and supply chain compromise.

Mitigation

Upgrade to version 8.39.0 or later.

References

• https://github.com/NationalSecurityAgency/emissary/pull/1286
• https://github.com/NationalSecurityAgency/emissary/pull/1288
• https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-3g6g-gq4r-xjm9

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner