CVE-2021-32096: Nsa Emissary

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code (for an eval call) via the CONSOLE_COMMAND_STRING parameter.

Affected products

• Nsa Emissary: version 5.9.0 only

Published 2021-05-07. Last modified 2026-06-17.