CVE-2026-35580
Critical · 9.1CVSS
9.1
EPSS
0.7%
Published
Apr 7, 2026
CISA due date
—
The record
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to repository poisoning and supply chain compromise affecting all downstream users. This vulnerability is fixed in 8.39.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | Botan | 0 | 3.11.1-1.1 |
Related vulnerabilities
- CVE-2026-35582 Emissary is a P2P based data-driven workflow engine. Also affects Botan
- CVE-2024-50382 Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced… Also affects Botan
- CVE-2024-34702 Botan is a C++ cryptography library. Also affects Botan
- CVE-2024-39312 Botan is a C++ cryptography library. Also affects Botan
- CVE-2024-34703 Botan is a C++ cryptography library. Also affects Botan
- CVE-2026-114575 A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. CWE-77
- CVE-2026-112942 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-77
- CVE-2026-55453 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-77