[GHSA-2q4c-3mrw-63c3] Kopia: RCE via SSH ProxyCommand Injection

[poeck]

Updates

• References

Comments
The added reference provides broader technical context for this advisory, including a root-cause analysis and remediation guidance. It is intended to help users understand the advisory impact and mitigation details.

[github]

Hi there @jkowalski! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[github-actions]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.

[poeck]

bump

[taladrane]

Hi @poeck, thanks for the contribution!

Per our contribution guidelines:

Advisory references are intended to be supplemental, relevant information for the reader. We aim to include primary source references provided by the CVE or GHSA authors, supplement with relevant code or documentation when applicable, and focus on concision and relevance for any additional references. We generally avoid including secondary source write ups on advisories unless they are provided by the upstream source.

The reference you've proposed (https://blinkdisk.com/security/analysis/cve-2026-45695) is a third-party write-up rather than content published by the upstream Kopia project or the CVE/GHSA authors, so it falls into the category of secondary source material we don't typically include. The advisory already links to the upstream fix PR and the Kopia package, which cover the primary source information for this vulnerability.

We're going to close this one out, but we appreciate you taking the time to suggest an improvement. Thanks again!