https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 07:39:06 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-54442 <p>Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0.</p> <p>Emissary is a P2P based data-driven workflow engine. Prior to 8.51.0, the VALID_LINK validation in src/main/java/emissary/server/mvc/NavAction.java accepts protocol-relative URLs when processing configured navigation links. Browser URL normalization can interpret these accepted strings as external origins. The authoritative advisory attributes open redirect, server-side request forgery, and cloud metadata access to this bypass, but it identifies neither the server-side dereference path nor how navigation-link processing reaches that path. This issue is fixed in version 8.51.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-54442 https://db.gcve.eu/vuln/ghsa-c6q7-wqw2-h65w <p><strong>Affected:</strong> Maven: gov.nsa.emissary:emissary</p> <p>### Summary</p> <p>The URL validation regex `^(https?:/)?/.*` added to emissary&#39;s `NavAction.java` allows protocol-relative URLs (`//evil.com/...`) and single-slash scheme variants (`http:/evil.com`) to bypass validation, enabling SSRF and open redirect attacks.</p> <p>### Affected Package</p> <p>- **Ecosystem:** Maven - **Package:** NationalSecurityAgency/emissary - **Affected versions:** &lt; e2078417464b - **Patched versions:** &gt;= e2078417464b</p> <p>### Severity</p> <p>Medium</p> <p>### CWE</p> <p>CWE-918 — Server-Side Request Forgery (SSRF)</p> <p>### Details</p> <p>The fix in `NavAction.java` (line 47) introduces a `VALID_LINK` pattern:</p> <p>```java Pattern.compile(&#34;^(https?:/)?/.*&#34;) ```</p> <p>This regex is intended to restrict navigation links to relative paths and HTTP/HTTPS URLs. However, it has multiple bypass vectors.</p> <p>Protocol-relative URLs (`//evil.com/...`): The group `(https?:/)?` is optional, so the pattern reduces to `//.*` when the group is absent. This matches `//evil.com/steal?c=SESSION`, which browsers resolve to the current page&#39;s protocol plus the attacker&#39;s host.</p> <p>Single-slash scheme (`http:/evil.com`): The regex group captures `http:/` as a valid match, and browsers normalize `http:/evil.com` to `http://evil.com`, creating an open redirect to the attacker&#39;s server.</p> <p>Protocol-relative to cloud metadata (`//169.254.169.254/...`): This enables SSRF to cloud instance metadata endpoints, which is particularly dangerous in AWS/GCP environments where IAM credentials can be retrieved.</p> <p>The pre-fix code had no validation at…</p> <p><strong>Affected:</strong> Maven: gov.nsa.emissary:emissary</p> <p>### Summary</p> <p>The URL validation regex `^(https?:/)?/.*` added to emissary&#39;s `NavAction.java` allows protocol-relative URLs (`//evil.com/...`) and single-slash scheme variants (`http:/evil.com`) to bypass validation, enabling SSRF and open redirect attacks.</p> <p>### Affected Package</p> <p>- **Ecosystem:** Maven - **Package:** NationalSecurityAgency/emissary - **Affected versions:** &lt; e2078417464b - **Patched versions:** &gt;= e2078417464b</p> <p>### Severity</p> <p>Medium</p> <p>### CWE</p> <p>CWE-918 — Server-Side Request Forgery (SSRF)</p> <p>### Details</p> <p>The fix in `NavAction.java` (line 47) introduces a `VALID_LINK` pattern:</p> <p>```java Pattern.compile(&#34;^(https?:/)?/.*&#34;) ```</p> <p>This regex is intended to restrict navigation links to relative paths and HTTP/HTTPS URLs. However, it has multiple bypass vectors.</p> <p>Protocol-relative URLs (`//evil.com/...`): The group `(https?:/)?` is optional, so the pattern reduces to `//.*` when the group is absent. This matches `//evil.com/steal?c=SESSION`, which browsers resolve to the current page&#39;s protocol plus the attacker&#39;s host.</p> <p>Single-slash scheme (`http:/evil.com`): The regex group captures `http:/` as a valid match, and browsers normalize `http:/evil.com` to `http://evil.com`, creating an open redirect to the attacker&#39;s server.</p> <p>Protocol-relative to cloud metadata (`//169.254.169.254/...`): This enables SSRF to cloud instance metadata endpoints, which is particularly dangerous in AWS/GCP environments where IAM credentials can be retrieved.</p> <p>The pre-fix code had no validation at…</p> https://db.gcve.eu/vuln/ghsa-c6q7-wqw2-h65w