Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-35571 Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into hr… https://www.cve.org/CVERecord?id=CVE-2026-35571
Post summary
The tweet merely points to a CVE record for Emissary and briefly mentions a template interpolation issue, offering no details on PoC, exploit, patches, or active exploitation.
CVE-2026-35571 Stored Cross-Site Scripting in Emissary Prior to Version 8.39.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35571
Post summary
The post announces CVE‑2026‑35571 as a stored XSS vulnerability in Emissary prior to version 8.39.0, with no evidence of a PoC, exploit tool, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nsa | emissary | - | - | - |