gov.nsa:emissary 8.0.0-M8

Direct Vulnerabilities

Known vulnerabilities in the gov.nsa:emissary package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Cross-site Scripting (XSS) Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the rendering of Mustache navigation templates when user-controlled values are interpolated into the `href` attribute without proper URL scheme validation. An attacker can execute arbitrary JavaScript in the context of another authenticated user's browser by configuring a malicious `navItems` link value containing a `javascript:` URI and convincing the victim to click the crafted navigation link. This is only exploitable if the attacker has administrative access to modify the navigation configuration and the victim interacts with the malicious link. How to fix Cross-site Scripting (XSS)? There is no fixed version for `gov.nsa:emissary`.	[0,)
M Directory Traversal Affected versions of this package are vulnerable to Directory Traversal via the `validate` function in the `/api/configuration/{name}` configuration API endpoint. An attacker can gain unauthorized read access to sensitive configuration files outside the intended directory by submitting specially crafted configuration names using URL-encoded, double-encoded, or Unicode-normalized path traversal sequences. How to fix Directory Traversal? There is no fixed version for `gov.nsa:emissary`.	[0,)
H Command Injection Affected versions of this package are vulnerable to Command Injection via the `Executrix` utility when configuration-derived values, such as `PLACE_NAME`, are concatenated into shell commands without sufficient sanitization. An attacker can achieve arbitrary command execution by supplying specially crafted configuration values containing shell metacharacters. How to fix Command Injection? There is no fixed version for `gov.nsa:emissary`.	[0,)

Vulnerability

Vulnerable Version

Cross-site Scripting (XSS)

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the rendering of Mustache navigation templates when user-controlled values are interpolated into the href attribute without proper URL scheme validation. An attacker can execute arbitrary JavaScript in the context of another authenticated user's browser by configuring a malicious navItems link value containing a javascript: URI and convincing the victim to click the crafted navigation link. This is only exploitable if the attacker has administrative access to modify the navigation configuration and the victim interacts with the malicious link.

How to fix Cross-site Scripting (XSS)?

There is no fixed version for gov.nsa:emissary.

[0,)

Directory Traversal

Affected versions of this package are vulnerable to Directory Traversal via the validate function in the /api/configuration/{name} configuration API endpoint. An attacker can gain unauthorized read access to sensitive configuration files outside the intended directory by submitting specially crafted configuration names using URL-encoded, double-encoded, or Unicode-normalized path traversal sequences.

How to fix Directory Traversal?

There is no fixed version for gov.nsa:emissary.

[0,)

Command Injection

Affected versions of this package are vulnerable to Command Injection via the Executrix utility when configuration-derived values, such as PLACE_NAME, are concatenated into shell commands without sufficient sanitization. An attacker can achieve arbitrary command execution by supplying specially crafted configuration values containing shell metacharacters.

How to fix Command Injection?

There is no fixed version for gov.nsa:emissary.

[0,)

gov.nsa:emissary@8.0.0-M8

latest version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically