Read the docs
TI-2025-41377 Aliases CVE-2025-67634GHSA-5m87-3r8p-jp6j

Software Acquisition Guide Supplier Response Web Tool XSS

Priority MEDIUM 54CWE-79Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-crafted JSON file, the Tool would load JavaScript from the file into the page. The JavaScript would execute in the context of the user's browser when the user submits the page (clicks 'Next').

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0019 8th percentileScored 2026-11-07
Fix Fixed Software Acquisition Guide Tool (CISA): 2025-12-11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CISASoftware Acquisition Guide Toolbefore 2025-12-112025-12-11Patch availableCNA
  • Software Acquisition Guide Tool VendorCISA Affected before 2025-12-11 Fixed in 2025-12-11 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cisa:software_acquisition_guide:*:*:*:*:*:*:*:*before 2025-12-11VulnerableCISA
  • cpe:2.3:a:cisa:software_acquisition_guide:*:*:*:*:*:*:*:* Versions before 2025-12-11 Vulnerable ·CISA

Remediation

  • Fix · CNA Software Acquisition Guide Tool (CISA) Fixed in 2025-12-11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-67634
  2. 2026-10-03 Alias added: GHSA-5m87-3r8p-jp6j

References

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences