CVE-2026-35581 is a command injection vulnerability in the Executrix utility class of the Emissary project. The vulnerability arises because the PLACE_NAME configuration parameter is sanitized only by replacing spaces with underscores, allowing shell metacharacters to pass through into commands executed via /bin/sh -c. This enables an attacker with the ability to control configuration values to execute arbitrary commands on the host. The issue is fixed in Emissary release 8.39.0 by applying an allowlist regex that replaces all non-alphanumeric, non-underscore, and non-hyphen characters with underscores.