CVE-2026-35571

CVE-2026-35571 affects Emissary prior to 8.39.0. Mustache navigation templates interpolated config-controlled link values directly into href attributes without URL scheme validation, allowing an administrator with navItems access to inject javascript: URIs and trigger stored XSS against other aut...

PT-2026-30890

Name of the Vulnerable Software and Affected Versions Emissary versions prior to 8.39.0 Description Emissary, a P2P based data-driven workflow engine, was found to have a stored cross-site scripting XSS issue. Prior to version 8.39.0, Mustache navigation templates interpolated...

CVE-2026-35571: Improper Neutralization of Input During Web Page Generation

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript:...