4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35571

CVE-2026-35571: Emissary has Stored XSS via Navigation Template Link Injection

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35571

CVE-2026-35571:

4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gov.nsa.emissary:emissary	maven	<= 8.38.0	8.39.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the Emissary web interface's navigation bar. The root cause is the lack of server-side validation for the link values of navigation items, which are configurable by an administrator. The emissary.server.mvc.NavAction.EmissaryNav.convert function was identified as the vulnerable function. This function is responsible for processing the configured navigation items. Before the fix, it would directly take the link value from the configuration and prepare it for rendering in the nav.mustache template. An attacker with administrative privileges could set a navigation item's link to a javascript: URI. When any authenticated user clicks this link, the JavaScript payload executes in their browser context, allowing for session hijacking or other malicious actions. The patch addresses this by introducing a new method, isValidLink, which uses a regular expression to allowlist only http://, https://, and relative URLs. The convert method was modified to use this validation, filtering out any invalid links before they are rendered.

Vulnerable functions

emissary.server.mvc.NavAction.EmissaryNav.convert

src/main/java/emissary/server/mvc/NavAction.java

The `convert` method in the `emissary.server.mvc.NavAction.EmissaryNav` class processes navigation links provided in the configuration. Prior to the patch, this method did not validate the scheme of the link, allowing `javascript:` URIs to be stored. When a user clicks on a maliciously crafted navigation link, the JavaScript code executes in the user's browser, leading to a stored cross-site scripting (XSS) vulnerability. The patch fixes this by adding a filter that uses the `isValidLink` method to ensure only safe URL schemes are processed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.