What is the CVSS score of CVE-2026-35571?

CVE-2026-35571 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35571?

Yes, a patch is available for CVE-2026-35571. Update the affected software to the latest version immediately.

Emissary CVE-2026-35571

EUVD-2026-19724 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-07 GitHub_M

GHSA-cpm7-cfpx-3hvp

XSS Emissary

4.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 08, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 07, 2026 - 16:00 euvd

EUVD-2026-19724

Analysis Generated

Apr 07, 2026 - 16:00 vuln.today

CVE Published

Apr 07, 2026 - 15:26 nvd

MEDIUM 4.8

DescriptionGitHub Advisory

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0.

AnalysisAI

Stored cross-site scripting in Emissary prior to 8.39.0 allows authenticated administrators to inject malicious javascript: URIs into navigation item configuration, which are then rendered unsafely in href attributes viewed by other authenticated users. The vulnerability requires high-privilege administrative access to modify navItems configuration but affects all other users accessing the web interface, with confirmed fix available in version 8.39.0.

Technical ContextAI

Emissary uses Mustache templating to render navigation items from configuration-controlled data. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation-Cross-site Scripting) where user-supplied or configuration-controlled link values are interpolated directly into HTML href attributes without URL scheme validation. An attacker with administrative privileges can inject javascript: protocol URIs (e.g., href='javascript:alert(document.cookie)') into the navItems configuration object. When other authenticated users view the Emissary web interface, their browsers execute the injected JavaScript in the context of the application origin. The fix involves validating that href values conform to safe URL schemes (http, https) before rendering them in templates, preventing javascript: and data: protocol injection.

RemediationAI

Vendor-released patch: Upgrade Emissary to version 8.39.0 or later, which includes URL scheme validation for href attributes in Mustache navigation templates. Organizations unable to upgrade immediately should audit all navItems configuration entries to remove or validate any navigation links, paying particular attention to entries containing javascript:, data:, or other non-standard URI schemes. Review access logs and authentication records to identify if any unauthorized configuration modifications occurred. Restrict administrative access to configuration systems to only trusted personnel and enable audit logging for configuration changes.