CVE-2026-35580CWE-77

Emissary has GitHub Actions Shell Injection via Workflow Inputs

Critical · published April 7, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
52.3
In the wild
Unconfirmed
What it is

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to repository poisoning and supply chain compromise affecting all downstream users. This vulnerability is fixed in 8.39.0.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00692 · 52.3th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-04-07T15:55Z
EPSS history
Timeline
  • 07 APR 15:55Z
    Emissary has GitHub Actions Shell Injection via Workflow Inputs
    cvelistv5