Executrix.getCommand() in Emissary versions 8.42.0 and earlier concatenates unvalidated IN_FILE_ENDING and OUT_FILE_ENDING values directly into a /bin/sh -c command string. Because the framework performs no escaping or input validation on these values, a configuration author who can edit a .cfg file can insert arbitrary shell metacharacters. The injected characters are executed by the JVM process with its local security context, giving the attacker the ability to run any OS command on the system where the framework is deployed.

Emissary, a peer‑to‑peer workflow engine produced by the National Security Agency, is affected for all releases up to and including 8.42.0. The issue has been fixed in version 8.43.0, so installations that have not applied this update remain vulnerable.

The CVSS score of 8.8 classifies the vulnerability as high severity. Exploitation requires only the ability to modify configuration files, a privilege that does not depend on network or API access. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Because the injected command runs under the JVM process’s security context, successful exploitation can lead to full system compromise in environments where configuration authors have write access.