High severity · published Mar 5, 2025
CVE-2025-27508
Emissary Use of a Broken or Risky Cryptographic Algorithm
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
Emissary is a P2P based data-driven workflow engine. The ChecksumCalculator class within allows for hashing and checksum generation, but it includes or defaults to algorithms that are no longer recommended for secure cryptographic use cases (e.g., SHA-1, CRC32, and SSDEEP). These algorithms, while possibly valid for certain non-security-critical tasks, can expose users to security risks if used in scenarios where strong cryptographic guarantees are required. This issue is fixed in 8.24.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
emissary · NationalSecurityAgency
< 8.24.0 · source: vendor
Affected product
EM
emissary
NationalSecurityAgency
More from emissary
9.1
CVE-2026-35580
Emissary has GitHub Actions Shell Injection via Workflow Inputs
8.8
CVE-2026-35582
Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
7.2
CVE-2026-35581
Emissary has a Command Injection via PLACE_NAME Configuration in Executrix
5.3
CVE-2026-35583
Emissary has a Path Traversal via Blacklist Bypass in Configuration API
4.8
CVE-2026-35571
Emissary has Stored XSS via Navigation Template Link Injection