How can CNA support the enrichment of imported advisories

[ohader]

Example

TYPO3 (as CNA) published CVE-2025-59013 which has been imported as unreviewed advisories into the GitHub advisory database. It seems that the imported data lacks details on the affected version ranges.

• CVE JSON from CVE.org: https://cveawg.mitre.org/api/cve/CVE-2025-59013
• Imported JSON/OSV on GitHub: https://github.com/github/advisory-database/blob/2b7dfd85a86d20aa9f79453e011f4882cc2d836d/advisories/unreviewed/2025/09/GHSA-72jf-5fg5-3cw3/GHSA-72jf-5fg5-3cw3.json

The affected section in the GH import is empty - however, the details were provided in the original CVE.

Questions

• How can TYPO3 as CNA support having proper affected version information available?
• How can TYPO3 as CNA enrich the credits section pointing to corresponding GitHub users?
  (OSV supports credits[].contact which might be used to point to a GitHub user profile, e.g. https://github.com/ohader)