CVE-2026-35581: Emissary has a Command Injection via PLACE_NAME Configuration in Executrix

April 8, 2026 (updated November 4, 2026)

The Executrix utility class constructed shell commands by concatenating configuration-derived values — including the PLACE_NAME parameter — with insufficient sanitization. Only spaces were replaced with underscores, allowing shell metacharacters (;, |, $, `, (, ), etc.) to pass through into /bin/sh -c command execution.

References

github.com/NationalSecurityAgency/emissary/pull/1290
github.com/NationalSecurityAgency/emissary/releases/tag/8.39.0
github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-6c37-7w4p-jg9v
github.com/advisories/GHSA-6c37-7w4p-jg9v
nvd.nist.gov/vuln/detail/CVE-2026-35581

Code Behaviors & Features

Detect and mitigate CVE-2026-35581 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →