Emissary versions prior to 8.39.0 contain a stored cross-site scripting (XSS) vulnerability in the navigation template. The vulnerability arises because navigation link URLs are interpolated into href attributes without validating the URL scheme, allowing an administrator to inject javascript: URIs. Authenticated users who click such malicious links can execute arbitrary scripts in their browser context, potentially leading to session hijacking and actions performed on their behalf. Exploitation requires administrative access to modify navigation configuration and user interaction. The issue is fixed in version 8.39.0 by adding server-side URL scheme validation and template hardening.