https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 00:35:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-281239 EUVD-2026-281239 https://cve.radiocsirt.org/vuln/euvd-2026-281239 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35571 <p>Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0.</p> <p>Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface. This vulnerability is fixed in 8.39.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-35571 https://cve.radiocsirt.org/vuln/ghsa-cpm7-cfpx-3hvp <p><strong>Affected:</strong> Maven: gov.nsa.emissary:emissary</p> <p>## Summary</p> <p>Mustache navigation templates interpolated configuration-controlled link values directly into `href` attributes without URL scheme validation. An administrator who could modify the `navItems` configuration could inject `javascript:` URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface.</p> <p>## Details</p> <p>### Vulnerable code — `nav.mustache` (line 10)</p> <p>```html {{#navItems}} &lt;li class=&#34;nav-item&#34;&gt; &lt;a class=&#34;nav-link&#34; href=&#34;{{link}}&#34;&gt;{{display}}&lt;/a&gt; &lt;/li&gt; {{/navItems}} ```</p> <p>The `{{link}}` value was rendered without any scheme validation. Mustache&#39;s default HTML escaping protects against injection of new HTML tags but does **not** prevent `javascript:` URIs in `href` attributes, since `javascript:` contains no characters that HTML-escaping would alter.</p> <p>### Attack vector</p> <p>An administrator sets a navigation item&#39;s link to: ``` javascript:alert(document.cookie) ```</p> <p>Any authenticated user who clicks the navigation link executes the script in their browser context.</p> <p>### Impact</p> <p>- Session hijacking via cookie theft - Actions performed on behalf of the victim user - Requires administrative access to modify navigation configuration - Requires user interaction (clicking the malicious link)</p> <p>### Mitigating factors</p> <p>- Exploitation requires administrative access to modify the `navItems` configuration - User interaction (clicking the link) is required - The Emissary web interface is typically accessed only by authent…</p> <p><strong>Affected:</strong> Maven: gov.nsa.emissary:emissary</p> <p>## Summary</p> <p>Mustache navigation templates interpolated configuration-controlled link values directly into `href` attributes without URL scheme validation. An administrator who could modify the `navItems` configuration could inject `javascript:` URIs, enabling stored cross-site scripting (XSS) against other authenticated users viewing the Emissary web interface.</p> <p>## Details</p> <p>### Vulnerable code — `nav.mustache` (line 10)</p> <p>```html {{#navItems}} &lt;li class=&#34;nav-item&#34;&gt; &lt;a class=&#34;nav-link&#34; href=&#34;{{link}}&#34;&gt;{{display}}&lt;/a&gt; &lt;/li&gt; {{/navItems}} ```</p> <p>The `{{link}}` value was rendered without any scheme validation. Mustache&#39;s default HTML escaping protects against injection of new HTML tags but does **not** prevent `javascript:` URIs in `href` attributes, since `javascript:` contains no characters that HTML-escaping would alter.</p> <p>### Attack vector</p> <p>An administrator sets a navigation item&#39;s link to: ``` javascript:alert(document.cookie) ```</p> <p>Any authenticated user who clicks the navigation link executes the script in their browser context.</p> <p>### Impact</p> <p>- Session hijacking via cookie theft - Actions performed on behalf of the victim user - Requires administrative access to modify navigation configuration - Requires user interaction (clicking the malicious link)</p> <p>### Mitigating factors</p> <p>- Exploitation requires administrative access to modify the `navItems` configuration - User interaction (clicking the link) is required - The Emissary web interface is typically accessed only by authent…</p> https://cve.radiocsirt.org/vuln/ghsa-cpm7-cfpx-3hvp