The vulnerability arises when the Emissary Executrix utility concatenates configuration values, such as PLACE_NAME, directly into shell commands with only whitespace replaced by underscores. This allows shell metacharacters (for example ; | $ ` ( )) to reach /bin/sh -c, giving an attacker the ability to run arbitrary commands. The weakness is a classic command injection flaw under CWE-78. Such exploitation could compromise confidentiality, integrity, and availability of the host system by ensuring that arbitrary code runs with the permissions of the Emissary process.

The affected product is the Emissary workflow engine supplied by the National Security Agency. Versions of Emissary older than 8.39.0 are vulnerable. No other vendors or product lines are listed.

The CVSS score of 7.2 indicates a high severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a maliciously crafted PLACE_NAME configuration entry, which an attacker can supply if they have the ability to modify configuration files or the management interface. This requires the attacker to have write access to Emissary configuration, after which arbitrary shell commands can be executed on the host.