Shell Injection Vulnerability in Emissary Workflow Engine by National Security Agency

CVE-2026-35580

What is CVE-2026-35580?

The Emissary workflow engine, developed by the National Security Agency, faces a security challenge due to shell injection vulnerabilities in its GitHub Actions workflow files prior to version 8.39.0. The issue arises when user-controlled inputs from the workflow_dispatch feature are directly used in shell commands without adequate validation, allowing attackers with repository write permissions to exploit this flaw. This could result in arbitrary command execution, potentially leading to repository poisoning and compromises in the supply chain, impacting downstream users. Users are encouraged to upgrade to version 8.39.0 or later to mitigate this risk.

References