CVE-2026-54442

The NationalSecurityAgency/emissary workflow engine contains an incomplete fix for CVE-2026-35571 (an SSRF vulnerability). The validation regex ^(https?:/)?/.* in NavAction.java allows bypasses via protocol-relative URLs (e.g., //evil.com/) and single-slash schemes (e.g., http:/evil.com). These b...