pvharmo2/gha-lab-ed7a1740c4Security-research lab: controlled reproduction of GHSA-3g6g-gq4r-xjm9 / CVE-2026-35580 (GitHub Actions workflow_dispatch input shell injection) against a pinned snapshot of NationalSecurityAgency/emissary
Automated research artifact — not the upstream project.
This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of
NationalSecurityAgency/emissaryat commit898488b489615581ea66d17954742c8e4ffb0323(2026-01-09), redistributed under that project's own licence, whose file is included unchanged in this snapshot.The upstream project is not involved, is never targeted, and the vulnerability studied here is already public. Every secret and variable in this repository is a randomly generated dummy value — no real credential is present. Action references and runner images are pinned to what they resolved to on 2026-01-09; see
pinning.mdin the harness output for every change made to the snapshot.Questions or objections: [email protected]
Emissary is a P2P based data-driven workflow engine that runs in a heterogeneous possibly widely dispersed, multi-tiered P2P network of compute resources. Workflow itineraries are not pre-planned as in conventional workflow engines, but are discovered as more information is discovered about the data. There is typically no user interaction in an Emissary workflow, rather the data is processed in a goal oriented fashion until it reaches a completion state.
Emissary is highly configurable, but in this base implementation does almost nothing. Users of this framework are expected to provide classes that extend emissary.place.ServiceProviderPlace to perform work on emissary.core.IBaseDataObject payloads.
A variety of things can be done and the workflow is managed in stages, e.g. STUDY, ID, COORDINATE, TRANSFORM, ANALYZE, IO, REVIEW.
The classes responsible for directing the workflow are the emissary.core.MobileAgent and classes derived from it, which manage the path of a set of related payload objects through the workflow and the emissary.directory.DirectoryPlace which manages the available services, their cost and quality and keep the P2P network connected.
Read through the DEVELOPING.md guide for information on installing required components, pulling the source code, building and running Emissary.
Run mvn clean package to compile, test, and package Emissary
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 9.132 s
[INFO] Finished at: 2022-01-10T22:31:05Z
[INFO] ------------------------------------------------------------------------
There is one bash script in Emissary that runs everything. It is in the top level Emissary directory. The script runs the emissary.Emissary class which has several Picocli commands available to handle different functions.
If the emissary script is run without any arguments, you will get a listing of all the configuration subcommands and a brief description.
./emissary
Running ./emissary help will give you the same output as running with no arguments. If you want to see more
detailed information on a command, add the command name after help. For example, see all the
arguments with descriptions for the server command, run:
./emissary help server
The rest of commands all have (-b or --projectBase) arguments that can be set, but it must match PROJECT_BASE.
The config directory is defaulted to /config but can also be passed in with (-c or --config). When running from the git checkout, you should use target as the projectBase. Feel free to modify config files in target/config before you start.
Logging is handled by logback. You can point to a custom file with the --logbackConfig argument.
See the help -c for each command to get more info.
This command will start up an Emissary server and initialize all the places, a pickup place, and drop off filters that are configured. It will start in standalone mode if -m or --mode is not specified. By default, the number of MobileAgents is calculated based on the specs of the machine. On modern computers, this can be high. You can control the number of agents with -a or --agents. Here is an example run.
./emissary server -a 2
Without further configuration, it will start on http://localhost:8001. If you browse to that url, you will need to enter the username and password defined in target/config/jetty-users.properties, which is emissary and emissary123.
The default PickUpPlace is configured to read files from target/data/InputData. If you copy files into that directory, you will see Emissary process them. Keep in mind, only toUpper and toLower are configured, so the output will not be too interesting.
Stop the service from taking work
./emissary server --pause