Emissary, a P2P data-driven workflow engine by the NationalSecurityAgency, had a stored XSS vulnerability (CWE-79) in versions before 8.39.0. The vulnerability occurs because Mustache templates used for navigation interpolate configuration-controlled link values directly into href attributes without validating the URL scheme. This allows an administrator who can modify the navItems configuration to inject javascript: URIs, enabling stored cross-site scripting attacks against other authenticated users viewing the web interface. The vulnerability is resolved in version 8.39.0.

An attacker with administrative privileges to modify the navItems configuration can inject malicious javascript: URIs into the Emissary web interface. This leads to stored XSS attacks that can impact the confidentiality and integrity of other authenticated users' sessions. The CVSS score of 4.8 reflects a medium severity with low complexity and requiring high privileges and user interaction. There is no indication of availability impact or known exploitation in the wild.

Upgrade Emissary to version 8.39.0 or later, where this vulnerability is fixed. Since the fix is included in this version, applying this official update is the recommended remediation. Patch status is not explicitly confirmed beyond the fix in 8.39.0, so verify with the vendor advisory before deployment. No alternative mitigations or temporary fixes are indicated.