CVE-2025-67634CWE-79cross-site-scripting

CVE-2025-67634

Medium · published December 13, 2025

CVSS v3.1
4.4
EPSS
0%
Percentile
8.2
In the wild
Unconfirmed
What it is

The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-crafted JSON file, the Tool would load JavaScript from the file into the page. The JavaScript would execute in the context of the user's browser when the user submits the page (clicks 'Next').

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00190 · 8.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-12-13T02:15Z
Affected products (1)
ProductVersionsFixed in
cisa/software_acquisition_guide< 2025-12-112025-12-11
References (3)
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-345-01.json · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cisa.gov/software-acquisition-guide/tool · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2025-67634 · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 12 DEC 20:36Z
    Software Acquisition Guide Supplier Response Web Tool XSS
    cvelistv5