{"id":"CVE-2026-35571","kind":"vulnerability","aliases":["CVE-2026-35571","GHSA-cpm7-cfpx-3hvp"],"related":[],"title":"Emissary has Stored XSS via Navigation Template Link Injection","description":"## Summary\n\nMustache navigation templates interpolated configuration-controlled link values\ndirectly into `href` attributes without URL scheme validation. An administrator\nwho could modify the `navItems` configuration could inject `javascript:` URIs,\nenabling stored cross-site scripting (XSS) against other authenticated users\nviewing the Emissary web interface.\n\n## Details\n\n### Vulnerable code — `nav.mustache` (line 10)\n\n```html\n{{#navItems}}\n<li class=\"nav-item\">\n  <a class=\"nav-link\" href=\"{{link}}\">{{display}}</a>\n</li>\n{{/navItems}}\n```\n\nThe `{{link}}` value was rendered without any scheme validation. Mustache's\ndefault HTML escaping protects against injection of new HTML tags but does\n**not** prevent `javascript:` URIs in `href` attributes, since `javascript:`\ncontains no characters that HTML-escaping would alter.\n\n### Attack vector\n\nAn administrator sets a navigation item's link to:\n```\njavascript:alert(document.cookie)\n```\n\nAny authenticated user who clicks the navigation link executes the script in\ntheir browser context.\n\n### Impact\n\n- Session hijacking via cookie theft\n- Actions performed on behalf of the victim user\n- Requires administrative access to modify navigation configuration\n- Requires user interaction (clicking the malicious link)\n\n### Mitigating factors\n\n- Exploitation requires administrative access to modify the `navItems`\n  configuration\n- User interaction (clicking the link) is required\n- The Emissary web interface is typically accessed only by authenticated\n  operators within a trusted network\n\n## Remediation\n\nFixed in [PR #1293](https://github.com/NationalSecurityAgency/emissary/pull/1293),\nmerged into release 8.39.0.\n\n### Server-side link validation — `NavAction.java`\n\nAn allowlist regex was added that only permits `http://`, `https://`, or\nsite-relative (`/`) URLs:\n\n```java\nprivate static final Pattern VALID_LINK = Pattern.compile(\"^(https?:/)?/.*\");\n\nprivate static boolean isValidLink(String link) {\n    if (!VALID_LINK.matcher(link).matches()) {\n        logger.warn(\"Skipping invalid navigation link '{}'\", link);\n        return false;\n    }\n    return true;\n}\n```\n\nInvalid links are logged and silently dropped from the rendered navigation.\n\n### Template hardening — `nav.mustache`\n\nAdded `rel=\"noopener noreferrer\"` to all navigation link anchor tags as a\ndefense-in-depth measure:\n\n```html\n<a class=\"nav-link\" href=\"{{link}}\" rel=\"noopener noreferrer\">{{display}}</a>\n```\n\nTests were added to verify that `javascript:` and `ftp://` URIs are rejected\nwhile `http://`, `https://`, and site-relative (`/path`) links are accepted.\n\n## Workarounds\n\nIf upgrading is not immediately possible, audit the navigation configuration\nto ensure all `navItems` link values use only `http://`, `https://`, or\nrelative (`/`) URL schemes.\n\n## References\n\n- [PR #1293 — validate nav links](https://github.com/NationalSecurityAgency/emissary/pull/1293)\n- Original report: GHSA-wjqm-p579-x3ww","summary":"Emissary's navigation template rendered configured link values into href attributes without checking the URL scheme. An administrator who can edit navItems can store a javascript: link that runs script in the browser of other signed-in users who click it, enabling cookie theft and actions as the victim.","severity":"medium","cvss":4.8,"epss":0.00176,"exploited":false,"exploited_at":null,"products":[{"name":"gov.nsa.emissary:emissary","fixed":["8.39.0"],"affected":"<= 8.38.0","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["cwe-79","emissary","java","maven","package","self-hosted"],"not_affected_if":["default-config","no-admin-navitems-edits"],"how_to_check":"- Check the Emissary version against `8.39.0`; releases up to and including `8.38.0` are affected.\n- Review the `navItems` configuration for any link value that is not `http://`, `https://`, or a `/` relative path.","fix":"- Emissary (maven gov.nsa.emissary:emissary): move to `8.39.0` or later.","status":"open","published_at":"2026-04-07T20:17:14+00:00","first_seen_at":"2026-11-04T22:10:17+00:00","triaged_at":"2026-11-04T22:11:28+00:00","updated_at":"2026-11-04T22:11:28+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T22:11:28Z","model":"claude-haiku-5-5","output":{"fix":"- Emissary (maven gov.nsa.emissary:emissary): move to `8.39.0` or later.","reach":"network","title":"Emissary: navigation links let an admin inject javascript URIs","impact":"medium","summary":"Emissary's navigation template rendered configured link values into href attributes without checking the URL scheme. An administrator who can edit navItems can store a javascript: link that runs script in the browser of other signed-in users who click it, enabling cookie theft and actions as the victim.","audience":"businesses","category":"package","nicknames":[],"who_cares":["emissary","java","maven","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Other users' browser sessions run attacker script and cookies are stolen","analyst_note":"","how_to_check":"- Check the Emissary version against `8.39.0`; releases up to and including `8.38.0` are affected.\n- Review the `navItems` configuration for any link value that is not `http://`, `https://`, or a `/` relative path.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","no-admin-navitems-edits"],"who_is_affected":"Teams running the Emissary web interface where administrators can edit navigation configuration. The risk needs an admin account to plant the link and a logged-in user to click it. Deployments that never edit navItems, or that only use http, https or relative links, are lower risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.00079,"input_tokens":5245,"output_tokens":531,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,19A '-35571':12A,20A '-79':24B '/nationalsecurityagency/emissary/pull/1293)':413C '/nationalsecurityagency/emissary/pull/1293),':276C '/navitems':137C '/path':378C '10':133C '1293':273C,407C '3hvp':17A '8.39.0':280C 'accept':381C 'access':224C,241C,260C 'action':78B,214C 'add':291C,343C,364C 'administr':49B,101C,182C,223C,240C 'alert':191C 'allowlist':288C 'alter':178C 'anchor':351C 'attack':179C 'attribut':42B,95C,167C 'audit':389C 'authent':121C,194C,263C 'behalf':217C 'boolean':311C 'browser':64B,206C 'cfpx':16A 'charact':172C 'check':44B 'click':72B,197C,232C,249C 'code':130C 'configur':37B,88C,107C,228C,246C,392C 'configuration-control':87C 'contain':170C 'context':207C 'control':89C 'cooki':75B,212C 'could':103C,108C 'cpm7':15A 'cross':115C 'cross-sit':114C 'cve':10A,18A 'cwe':23B 'default':149C 'defens':356C 'defense-in-depth':355C 'depth':358C 'detail':128C 'direct':92C 'display':136C,361C 'document.cookie':192C 'drop':335C 'edit':52B 'emissari':1A,25B,32B,125C,255C 'emissary':22A 'enabl':74B,112C 'ensur':394C 'escap':151C,176C 'execut':201C 'exploit':238C 'factor':237C 'fals':326C 'final':303C 'fix':270C 'ghsa':14A,417C 'ghsa-cpm7-cfpx-3hvp':13A 'ghsa-wjqm-p579-x3ww':416C 'github.com':275C,412C 'github.com/nationalsecurityagency/emissary/pull/1293)':411C 'github.com/nationalsecurityagency/emissary/pull/1293),':274C 'gov.nsa.emissary':21A 'harden':341C 'hijack':210C 'host':31B 'href':41B,94C,166C 'html':134C,150C,157C,175C,360C 'html-escap':174C 'https':308C 'immedi':387C 'impact':208C 'inject':9A,109C,154C 'interact':231C,248C 'interfac':127C,257C 'interpol':86C 'invalid':321C,329C 'isvalidlink':312C 'item':186C 'java':26B,300C 'javascript':57B,110C,163C,169C,190C,368C 'line':132C 'link':8A,38B,58B,90C,139C,188C,200C,235C,251C,284C,306C,314C,317C,323C,324C,330C,350C,379C,397C,410C 'log':332C 'logger.warn':319C 'malici':234C 'match':318C 'maven':27B 'measur':359C 'merg':277C 'mitig':236C 'modifi':104C,226C,243C 'mustach':83C,147C 'nav':409C 'nav.mustache':131C,342C 'navaction.java':286C 'navig':6A,34B,84C,185C,199C,227C,322C,339C,349C,391C 'navitem':53B,106C,135C,245C,396C 'network':268C 'new':156C 'noopen':345C 'noreferr':346C 'oper':264C 'origin':414C 'p579':419C 'packag':28B 'pattern':304C 'pattern.compile':307C 'perform':215C 'permit':294C 'possibl':388C 'pr':272C,406C 'prevent':162C 'privat':301C,309C 'protect':152C 'refer':405C 'regex':289C 'reject':372C 'rel':344C 'relat':298C,377C,402C 'releas':279C 'remedi':269C 'render':36B,142C,338C 'report':415C 'requir':222C,229C,239C,253C 'return':325C,327C 'run':60B 'scheme':47B,98C,145C,404C 'script':61B,117C,203C 'self':30B 'self-host':29B 'server':282C 'server-sid':281C 'session':209C 'set':183C 'side':283C 'sign':68B 'signed-in':67B 'silent':334C 'sinc':168C 'site':116C,297C,376C 'site-rel':296C,375C 'skip':320C 'static':302C,310C 'store':3A,55B,113C 'string':313C 'summari':82C 'tag':158C,352C 'templat':7A,35B,85C,340C 'test':362C 'theft':76B,213C 'true':328C 'trust':267C 'typic':259C 'upgrad':384C 'uri':111C,164C,370C 'url':46B,97C,299C,403C 'use':399C 'user':70B,122C,195C,221C,230C,247C 'valid':99C,146C,285C,305C,408C 'valid_link.matcher':316C 'valu':39B,91C,140C,398C 'vector':180C 'verifi':366C 'via':5A,211C 'victim':81B,220C 'view':123C 'vulner':129C 'web':126C,256C 'within':265C 'without':43B,96C,143C 'wjqm':418C 'workaround':382C 'would':177C 'x3ww':420C 'xss':4A,118C","nicknames":[],"mitigations":[],"who_affected":"Teams running the Emissary web interface where administrators can edit navigation configuration. The risk needs an admin account to plant the link and a logged-in user to click it. Deployments that never edit navItems, or that only use http, https or relative links, are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["govnsaemissaryemissary"],"ptokens":["emissary","gov","nsa"],"labels":["cwe79","emissary","java","maven","medium","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-04-06T22:12:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-cpm7-cfpx-3hvp","url":"https://github.com/advisories/GHSA-cpm7-cfpx-3hvp","severity":"medium","published_at":"2026-04-07T20:17:14+00:00","modified_at":"2026-11-04T22:07:22+00:00","first_seen_at":"2026-11-04T22:10:17+00:00","fetched_at":"2026-11-04T22:17:43+00:00","note":null}],"documents":[{"id":26403,"url":"https://github.com/NationalSecurityAgency/emissary/releases/tag/8.39.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":70903,"url":"https://api.github.com/repos/NationalSecurityAgency/emissary/security-advisories/GHSA-cpm7-cfpx-3hvp","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":26401,"url":"https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-cpm7-cfpx-3hvp","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-04-06T22:12:18+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":70905,"url":"https://github.com/NationalSecurityAgency/emissary/pull/1293","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":26402,"url":"https://github.com/NationalSecurityAgency/emissary/commit/e2078417464b9004620dde28dcbca2f73ea06c13","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[{"type":"epss","score":0.00176,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-35571"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}