The NationalSecurityAgency/emissary package contains a vulnerability in its URL validation logic within NavAction.java. The regex intended to restrict URLs allows protocol-relative URLs (e.g., //evil.com) and single-slash scheme variants (e.g., http:/evil.com) to bypass validation. This flaw enables server-side request forgery (SSRF) and open redirect attacks. The vulnerability affects versions prior to 8.51.0, which includes the commit e2078417464b that introduced the flawed regex. The issue is rated medium severity with a CVSS score of 4.8.