[ranjiGT]

Updates

• References

Comments

Summary

The advisory for CVE-2026-35571 (GHSA-cpm7-cfpx-3hvp) currently references the upstream security advisory, NVD record, fixing pull request #1293, and corresponding fix commit, but omits the official Emissary 8.39.0 release.

This PR adds the missing release reference to improve traceability between the upstream security fix and its published release.

Changes

Field	Before	After
References	Security advisory, NVD, fixing PR, and fix commit	Existing references plus the official Emissary 8.39.0 release

Supporting evidence

• Upstream security advisory: GHSA-cpm7-cfpx-3hvp
• Fixing PR: ui :: validate nav links NationalSecurityAgency/emissary#1293
• Original fix commit: NationalSecurityAgency/emissary@e207841
• Official release: https://github.com/NationalSecurityAgency/emissary/releases/tag/8.39.0

The official 8.39.0 release includes the navigation-link validation changes associated with PR #1293.

Technical justification

The existing references identify the code-level remediation, while the upstream release provides a direct link to the version in which that remediation was published.

Adding the release reference improves the advisory's remediation traceability without modifying its vulnerability metadata.

This addition documents the original XSS remediation. It does not claim that 8.39.0 resolves the separate, subsequently disclosed SSRF bypass tracked as CVE-2026-54442.

Scope

This is a reference-only improvement.

No changes are proposed to the description, affected package, affected or patched version ranges, severity, or CVSS vector.

[github]

Hi there @cfkoehler! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

🟢 Approval recommended

No active review issues are identified in the supplied evidence.

No open issues 🎉

What changed in this PR

This pull request improves remediation traceability for the Emissary stored XSS advisory by linking the official Emissary 8.39.0 release containing the fix.

Changes:

• Updates the advisory modification timestamp.
• Adds the official Emissary 8.39.0 release as a web reference.
• Leaves vulnerability metadata, affected versions, severity, and CVSS unchanged.

File	Description
advisories/​github-reviewed/​2026/​04/​GHSA-cpm7-cfpx-3hvp/​GHSA-cpm7-cfpx-3hvp.json	Adds the official Emissary 8.39.0 release reference and updates the modification timestamp.

_{Review effort: Lite (auto)}