Threats tagged 'ghsa-3p24-9x7v-7789'

A command injection vulnerability exists in the Emissary framework (CVE-2026-35582) due to unvalidated IN_FILE_ENDING and OUT_FILE_ENDING configuration keys. These values are concatenated into temporary file paths without sanitization and then substituted directly into shell commands executed via /bin/sh -c, allowing arbitrary OS command execution by a place author. No additional runtime privileges or network access are required. The vulnerability affects Emissary versions prior to 8.43.0 and is fixed in version 8.43.0.