https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-35582.htmlhttps://patchthecve.com/cve/CVE-2026-35582.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 8.8: Emissary is a P2P based data-driven workflow engine. In versions 8.42.0 and below, Executrix.getCommand() is vulnerable to OS command injection because it interpolates temporary file paths into a /bin/sh -c shell command string without any escaping or input validation. The IN_FILE_ENDING and OUT_FIhttps://patchthecve.com/cve/CVE-2026-35583.htmlhttps://patchthecve.com/cve/CVE-2026-35583.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 5.3: Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the configuration API endpoint (/api/configuration/{name}) validated configuration names using a blacklist approach that checked for \, /, .., and trailing .. This could potentially be bypassed using URL-encoded variants, double-ehttps://patchthecve.com/cve/CVE-2026-35581.htmlhttps://patchthecve.com/cve/CVE-2026-35581.htmlMon, 26 Oct 2026 21:10:00 +0000HIGH 7.2: Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the Executrix utility class constructed shell commands by concatenating configuration-derived values — including the PLACE_NAME parameter — with insufficient sanitization. Only spaces were replaced with underscores, allowing shellhttps://patchthecve.com/cve/CVE-2026-35580.htmlhttps://patchthecve.com/cve/CVE-2026-35580.htmlMon, 26 Oct 2026 21:10:00 +0000CRITICAL 9.1: Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. An attacker with repository write access cohttps://patchthecve.com/cve/CVE-2026-35571.htmlhttps://patchthecve.com/cve/CVE-2026-35571.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 4.8: Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates interpolated configuration-controlled link values directly into href attributes without URL scheme validation. An administrator who could modify the navItems configuration could inject javascript: URI