Emissary versions prior to 8.43.0 contain an OS command injection vulnerability in the Executrix.getCommand() method. The method constructs a /bin/sh -c command string by embedding temporary file paths derived from configuration keys IN_FILE_ENDING and OUT_FILE_ENDING without escaping or input validation. While placeName is sanitized via an allowlist, these file ending values are not, enabling injection of shell metacharacters. Exploitation requires only the ability to write or modify a .cfg file as a place author, with no additional privileges or network access. This flaw allows arbitrary OS command execution in the JVM process security context. The vulnerability is resolved in Emissary version 8.43.0.

Successful exploitation allows an attacker with place configuration author permissions to execute arbitrary OS commands within the JVM process context, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability, as reflected by the CVSS score of 8.8 (high severity). No network or API access is required, but the attacker must have write access to place configuration files.

This vulnerability is fixed in Emissary version 8.43.0. Users should upgrade to version 8.43.0 or later to remediate this issue. There is no safe workaround or mitigation available for affected versions, as the framework does not provide escaping or input validation for the vulnerable configuration keys. Until upgraded, restrict place configuration file write permissions to trusted users only.