Emissary versions prior to 8.39.0 contain a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, Mustache navigation templates interpolate configuration-controlled link values directly into href attributes without validating the URL scheme. This allows an administrator who can modify the navItems configuration to inject javascript: URIs, resulting in stored XSS attacks against other authenticated users of the Emissary web interface. The vulnerability is resolved in version 8.39.0.

Successful exploitation allows an administrator with configuration modification privileges to inject malicious javascript: URIs into navigation links. This leads to stored XSS attacks that can affect other authenticated users viewing the Emissary web interface, potentially compromising their session or executing arbitrary scripts in their browsers. The impact is limited to confidentiality and integrity with no reported availability impact. No known exploits have been observed in the wild.

Upgrade Emissary to version 8.39.0 or later, where this vulnerability is fixed. Since the vulnerability requires an administrator to modify the navItems configuration, limiting administrative access can reduce risk. Patch status is not explicitly stated in a vendor advisory, but the description confirms the issue is fixed in 8.39.0. No additional mitigations are indicated.