CVE-2026-35580 Emissary has GitHub Actions Shell Injection via Workflow Inputs
Attackers with repository write access can inject shell commands into GitHub Actions workflows, leading to supply chain compromise.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35580?
CVE-2026-35580 is a critical command injection vulnerability in NationalSecurityAgency emissary, published on 7 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to repository poisoning and supply chain compromise affecting all downstream users. This vulnerability is fixed in 8.39.0.
Weakness: CWE-77
Which versions are affected by CVE-2026-35580?
2 open source packages ship an affected version, including gov.nsa.emissary:emissary. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gov.nsa.emissary:emissary Maven | All versions | 8.39.0 |
gov.nsa.emissary:emissary Maven | All versions | 8.39.0 |
Products include Nsa Emissary.
How do I fix CVE-2026-35580?
Upgrade gov.nsa.emissary:emissary to 8.39.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-35580 being exploited?
There is no known exploitation of CVE-2026-35580 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in NationalSecurityAgency emissary
- CVE-2026-35582 Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
- CVE-2021-32094 File upload in n/a
- CVE-2021-32096 Cross-site request forgery in n/a
- CVE-2021-32095 Missing authorization in n/a
- CVE-2021-32647 Post-authentication Remote Code Execution (RCE) in emissary:emissary
Sources
Also known as GHSA-3g6g-gq4r-xjm9.