The vulnerability in the Emissary workflow engine allows an administrator with permission to modify the navigation configuration (navItems) to embed javascript: URLs directly into link href attributes. Because the engine inserts these values without validating the URL scheme, the stored link can trigger an XSS attack when other authenticated users view the web interface. Attacks can compromise user sessions, theft of credentials, or execution of malicious actions in the user’s context.

The flaw affects the National Security Agency’s Emissary platform prior to version 8.39.0. Any deployment using an earlier version that permits administrators to edit navItems is vulnerable. The affected product is the Emissary P2P workflow engine.

The CVSS score of 4.8 indicates a moderate risk level. An attacker would need administrative access to modify the navigation configuration, and there is no evidence that this flaw is listed in the CISA Known Exploited Vulnerabilities catalog or that a public exploit is available. The attack requires an authenticated administrator, so the likelihood of exploitation is limited to organizations that grant such privileges. Nevertheless, successful exploitation could lead to significant damage to confidentiality, integrity, and availability of affected users’ sessions.