Security Advisory

CVE-2026-35571

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2026-04-07 15:26:30

Last updated 2026-04-08 14:57:05

Assigner GitHub_M

State PUBLISHED

Description

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0.

← Browse all CVEs View on cve.org ↗