CVE-2026-35571: Emissary P2P Workflow Engine XSS Vulnerability

CVE-2026-35571 Overview

CVE-2026-35571 is a stored cross-site scripting (XSS) vulnerability in Emissary, a P2P-based data-driven workflow engine developed by the National Security Agency (NSA). Prior to version 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without proper URL scheme validation. This flaw allows an administrator with access to modify the navItems configuration to inject javascript: URIs, enabling stored XSS attacks against other authenticated users viewing the Emissary web interface.

Critical Impact

Authenticated administrators can inject malicious JavaScript through navigation configuration, compromising the sessions of other authenticated users accessing the Emissary web interface.

Affected Products

• Emissary versions prior to 8.39.0
• Emissary P2P data-driven workflow engine web interface
• Systems utilizing Mustache navigation templates with configurable navItems

Discovery Timeline

• 2026-04-07 - CVE-2026-35571 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-35571

Vulnerability Analysis

This vulnerability (CWE-79: Cross-Site Scripting) arises from insufficient input validation in the Mustache templating engine used by Emissary's navigation system. The web interface renders navigation items using Mustache templates that directly interpolate configuration values into HTML href attributes without validating the URL scheme.

When an administrator modifies the navItems configuration to include a javascript: URI instead of a legitimate HTTP/HTTPS URL, the malicious payload is stored in the application configuration. Subsequently, when any authenticated user loads a page containing the navigation menu, the malicious JavaScript executes in their browser context.

The attack requires an attacker to have administrative privileges to modify the navigation configuration, but once injected, the malicious payload persists and executes for all users who view the affected navigation elements. This represents a stored XSS scenario where the attack payload is permanently embedded in the application's configuration.

Root Cause

The root cause is the absence of URL scheme validation when processing navigation item links from the configuration. The Mustache template engine blindly trusts input from the navItems configuration and renders it directly into anchor tag href attributes. Without a whitelist of acceptable URL schemes (such as http:, https:, or relative URLs), the application fails to prevent dangerous schemes like javascript:, data:, or vbscript: from being rendered into the HTML output.

Attack Vector

The attack vector is network-based and requires the attacker to have high privileges (administrator access) to modify the Emissary configuration. The exploitation path involves:

1. An attacker with administrative access modifies the navItems configuration
2. The attacker injects a javascript: URI as a navigation link value
3. The Mustache template renders this value directly into an href attribute without validation
4. Any authenticated user viewing the navigation menu triggers the XSS payload when interacting with or hovering over the malicious link
5. The attacker can steal session tokens, perform actions as the victim user, or redirect users to malicious sites

The vulnerability mechanism involves the Mustache template directly interpolating the navigation link value into the HTML without sanitization. For example, a configuration value like javascript:alert(document.cookie) would be rendered directly into the navigation link's href attribute, executing arbitrary JavaScript when a user clicks the link.

For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-35571

Indicators of Compromise

• Navigation configuration entries containing javascript:, data:, or vbscript: URL schemes
• Unexpected modifications to the navItems configuration by administrative users
• Browser console errors or unexpected JavaScript execution when loading navigation menus
• Anomalous administrative configuration changes outside of normal maintenance windows

Detection Strategies

• Implement content security policy (CSP) headers to detect and block inline script execution
• Monitor application logs for configuration changes to navigation-related settings
• Deploy web application firewalls (WAF) with rules to detect javascript: URI patterns in configuration data
• Utilize browser-based XSS detection mechanisms that flag suspicious script execution contexts

Monitoring Recommendations

• Enable audit logging for all administrative configuration changes in Emissary
• Configure alerts for any modifications to navigation templates or navItems configuration
• Implement real-time monitoring of web interface traffic for XSS attack patterns
• Review administrator access logs for unauthorized or suspicious configuration modifications

How to Mitigate CVE-2026-35571

Immediate Actions Required

• Upgrade Emissary to version 8.39.0 or later immediately
• Audit existing navItems configuration for any suspicious javascript: or non-HTTP/HTTPS URLs
• Review administrative access logs for unauthorized configuration modifications
• Implement Content Security Policy headers to mitigate XSS impact as a defense-in-depth measure

Patch Information

The vulnerability has been fixed in Emissary version 8.39.0. The patch implements URL scheme validation to ensure only safe protocols are allowed in navigation link configurations. Organizations should upgrade to this version as soon as possible.

For patch details, see the GitHub Pull Request #1293 and the GitHub Security Advisory.

Workarounds

• Restrict administrative access to the Emissary configuration interface to only trusted personnel
• Implement manual review processes for any changes to navigation configurations
• Deploy a reverse proxy or WAF to filter requests containing javascript: URIs in configuration payloads
• Enable strict Content Security Policy headers to block inline JavaScript execution as a temporary mitigation

# Example: Add Content Security Policy header in Apache configuration as temporary mitigation
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"