Emissary Workflow Engine Vulnerable to OS Command Injection

The National Vulnerability Database (NVD) reports a critical OS command injection vulnerability, CVE-2026-35582, affecting Emissary, a P2P data-driven workflow engine. Specifically, versions 8.42.0 and below are impacted. The flaw resides in Executrix.getCommand(), which insecurely interpolates temporary file paths into /bin/sh -c shell commands. This allows an attacker to inject arbitrary shell metacharacters via the IN_FILE_ENDING and OUT_FILE_ENDING configuration keys.

The critical aspect here is that the framework already sanitizes placeName but completely misses these file ending values. An attacker only needs authorship of a .cfg file; no runtime privileges, API access, or network access are required. This is a fundamental framework-level defect, meaning downstream implementers have no safe mitigation beyond patching. The NVD assigns a CVSS score of 8.8 (High).

For defenders, this is a clear-cut case: if you’re running Emissary, you’re exposed. The attacker’s calculus is simple: gain configuration access, inject malicious commands, and achieve OS-level execution within the JVM process’s security context. This is a direct path to system compromise, data exfiltration, or further lateral movement.