[ranjiGT]

Updates

• References

Comments

Summary

The advisory for CVE-2026-54442 currently references the original incomplete URL-validation fix and Emissary 8.39.0, but omits the subsequent corrective commit and the patched Emissary 8.51.0 release.

This change adds the missing upstream remediation references to make the actual fix easier to identify and verify.

Changes

Field	Before	After
References	Original security advisories, incomplete fix commit, and 8.39.0 release	Retain existing references and append the corrective commit and 8.51.0 release

Supporting evidence

• Corrective upstream commit: NationalSecurityAgency/emissary@e0179f7
• Official patched release: https://github.com/NationalSecurityAgency/emissary/releases/tag/8.51.0
• Original upstream advisory: GHSA-c6q7-wqw2-h65w

The official Emissary 8.51.0 release identifies CVE-2026-54442 and the corresponding corrective commit.

Technical justification

The existing references document the earlier, incomplete validation fix. The additional commit and release links identify the subsequent remediation for the bypass described in this advisory.

Including both sets of references preserves the vulnerability's remediation history while allowing consumers to locate the actual corrective implementation.

Scope

This is a reference-only improvement.

No changes are proposed to the description, affected package, affected or patched version ranges, severity, or CVSS vector.

[github]

Hi there @cfkoehler! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

🟢 Approval recommended

The change is limited to documenting the upstream fix and patched release, with no active review issues identified.

No open issues 🎉

What changed in this PR

This reference-only update improves traceability for the Emissary URL-validation vulnerability by documenting the corrective upstream commit and the patched 8.51.0 release. Existing vulnerability metadata and references remain unchanged.

Changes:

• Added the corrective upstream commit reference.
• Added the Emissary 8.51.0 release reference.
• Updated the advisory modification timestamp.

File	Description
advisories/​github-reviewed/​2026/​10/​GHSA-c6q7-wqw2-h65w/​GHSA-c6q7-wqw2-h65w.json	Adds references documenting the complete remediation and patched release.

_{Review effort: Lite (auto)}

[advisory-database]

Hi @ranjiGT! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!