---
id: "CVE-2026-35571"
kind: "vulnerability"
aliases: ["CVE-2026-35571", "GHSA-cpm7-cfpx-3hvp"]
title: "Emissary has Stored XSS via Navigation Template Link Injection"
severity: "medium"
cvss: 4.8
epss: 0.00176
exploited: false
status: "open"
category: "package"
products: [{"name": "gov.nsa.emissary:emissary", "fixed": ["8.39.0"], "affected": "<= 8.38.0", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["cwe-79", "emissary", "java", "maven", "package", "self-hosted"]
not_affected_if: ["default-config", "no-admin-navitems-edits"]
published_at: "2026-04-07T20:17:14+00:00"
first_seen_at: "2026-11-04T22:10:17+00:00"
updated_at: "2026-11-04T22:11:28+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-cpm7-cfpx-3hvp", "first_seen_at": "2026-11-04T22:10:17+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00176, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-35571"}]
---

# Emissary has Stored XSS via Navigation Template Link Injection

Emissary's navigation template rendered configured link values into href attributes without checking the URL scheme. An administrator who can edit navItems can store a javascript: link that runs script in the browser of other signed-in users who click it, enabling cookie theft and actions as the victim.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:gov.nsa.emissary:emissary affected <= 8.38.0 fixed 8.39.0

## How to check

- Check the Emissary version against `8.39.0`; releases up to and including `8.38.0` are affected.
- Review the `navItems` configuration for any link value that is not `http://`, `https://`, or a `/` relative path.

## Fix

- Emissary (maven gov.nsa.emissary:emissary): move to `8.39.0` or later.

## Timeline

- 2026-11-04T22:10:17+00:00 ghsa https://github.com/advisories/GHSA-cpm7-cfpx-3hvp

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/NationalSecurityAgency/emissary/security-advisories/GHSA-cpm7-cfpx-3hvp
- [advisory] Maintainer's advisory: github.com https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-cpm7-cfpx-3hvp
- [fix] Release: github.com https://github.com/NationalSecurityAgency/emissary/releases/tag/8.39.0
- [fix] Patch: github.com https://github.com/NationalSecurityAgency/emissary/pull/1293
- [fix] Patch: github.com https://github.com/NationalSecurityAgency/emissary/commit/e2078417464b9004620dde28dcbca2f73ea06c13

## From the sources

## Summary

Mustache navigation templates interpolated configuration-controlled link values
directly into `href` attributes without URL scheme validation. An administrator
who could modify the `navItems` configuration could inject `javascript:` URIs,
enabling stored cross-site scripting (XSS) against other authenticated users
viewing the Emissary web interface.

## Details

### Vulnerable code — `nav.mustache` (line 10)

```html
{{#navItems}}
<li class="nav-item">
  <a class="nav-link" href="{{link}}">{{display}}</a>
</li>
{{/navItems}}
```

The `{{link}}` value was rendered without any scheme validation. Mustache's
default HTML escaping protects against injection of new HTML tags but does
**not** prevent `javascript:` URIs in `href` attributes, since `javascript:`
contains no characters that HTML-escaping would alter.

### Attack vector

An administrator sets a navigation item's link to:
```
javascript:alert(document.cookie)
```

Any authenticated user who clicks the navigation link executes the script in
their browser context.

### Impact

- Session hijacking via cookie theft
- Actions performed on behalf of the victim user
- Requires administrative access to modify navigation configuration
- Requires user interaction (clicking the malicious link)

### Mitigating factors

- Exploitation requires administrative access to modify the `navItems`
  configuration
- User interaction (clicking the link) is required
- The Emissary web interface is typically accessed only by authenticated
  operators within a trusted network

## Remediation

Fixed in [PR #1293](https://github.com/NationalSecurityAgency/emissary/pull/1293),
merged into release 8.39.0.

### Server-side link validation — `NavAction.java`

An allowlist regex was added that only permits `http://`, `https://`, or
site-relative (`/`) URLs:

```java
private static final Pattern VALID_LINK = Pattern.compile("^(https?:/)?/.*");

private static boolean isValidLink(String link) {
    if (!VALID_LINK.matcher(link).matches()) {
        logger.warn("Skipping invalid navigation link '{}'", link);
        return false;
    }
    return true;
}
```

Invalid links are logged and silently dropped from the rendered navigation.

### Template hardening — `nav.mustache`

Added `rel="noopener noreferrer"` to all navigation link anchor tags as a
defense-in-depth measure:

```html
<a class="nav-link" href="{{link}}" rel="noopener noreferrer">{{display}}</a>
```

Tests were added to verify that `javascript:` and `ftp://` URIs are rejected
while `http://`, `https://`, and site-relative (`/path`) links are accepted.

## Workarounds

If upgrading is not immediately possible, audit the navigation configuration
to ensure all `navItems` link values use only `http://`, `https://`, or
relative (`/`) URL schemes.

## References

- [PR #1293 — validate nav links](https://github.com/NationalSecurityAgency/emissary/pull/1293)
- Original report: GHSA-wjqm-p579-x3ww

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_