CVE-2026-35581 Emissary has a Command Injection via PLACE_NAME Configuration in Executrix

High 7.2 Published 7 Apr 2026 Updated 8 Apr 2026

Attackers can execute arbitrary shell commands via the PLACE_NAME configuration parameter in the Executrix utility class.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-35581?

CVE-2026-35581 is a high-severity command injection vulnerability in NationalSecurityAgency emissary, published on 7 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Executrix utility class constructed shell commands by concatenating configuration-derived values — including the PLACE_NAME parameter — with insufficient sanitization. Only spaces were replaced with underscores, allowing shell metacharacters (;, |, $, `, (, ), etc.) to pass through into /bin/sh -c command execution. This vulnerability is fixed in 8.39.0.

Weakness: CWE-78

Which versions are affected by CVE-2026-35581?

2 open source packages ship an affected version, including gov.nsa.emissary:emissary. It affects 1 product.

Package	Affected	Fixed in
`gov.nsa.emissary:emissary` Maven	All versions	`8.39.0`
`gov.nsa.emissary:emissary` Maven	All versions	`8.39.0`

Products include Nsa Emissary.

How do I fix CVE-2026-35581?

Upgrade gov.nsa.emissary:emissary to 8.39.0 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-35581 being exploited?

There is no known exploitation of CVE-2026-35581 in the wild and no public exploit code.

Sources

Also known as GHSA-6c37-7w4p-jg9v.