CVE-2026-35571: Nsa Emissary

Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0.

Affected products

• Nsa Emissary: up to and including 8.38.0

Published 2026-04-07. Last modified 2026-06-17.