CVE-2025-67634: CISA Software Acquisition Guide XSS Flaw

CVE-2025-67634 Overview

CVE-2025-67634 is a cross-site scripting [CWE-79] vulnerability affecting the CISA Software Acquisition Guide Supplier Response Web Tool in versions released before 2025-12-11. The tool fails to sanitize text fields when importing user-supplied JSON files. An attacker who convinces a user to import a specially-crafted JSON file can embed JavaScript that executes in the user's browser when the user clicks 'Next' to submit the page. The vulnerability requires local access and user interaction to exploit.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of the victim's browser session by tricking suppliers into importing a malicious JSON response file, potentially compromising session data and page integrity.

Affected Products

CISA Software Acquisition Guide Supplier Response Web Tool (all versions before 2025-12-11)
Component: cisa:software_acquisition_guide
Web-based supplier response import functionality

Discovery Timeline

2025-12-12 - CVE-2025-67634 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-67634

Vulnerability Analysis

The CISA Software Acquisition Guide Supplier Response Web Tool allows suppliers to import previously exported JSON files containing their responses to acquisition questions. The tool loads text field values from these JSON files directly into the page without proper output encoding or input sanitization. When a user later submits the form by clicking 'Next', any JavaScript embedded in those text fields is interpreted and executed by the browser. This constitutes a client-side cross-site scripting flaw where the malicious payload is delivered via file import rather than a network request. The attack surface is limited to users who manually import an attacker-supplied file into the tool.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The tool trusts the contents of imported JSON text fields and renders them into the DOM without applying context-appropriate escaping. Because the payload becomes part of the page after import, subsequent navigation actions trigger execution within the same-origin browser context of the Supplier Response Web Tool.

Attack Vector

Exploitation requires an attacker to craft a JSON file containing JavaScript payloads inside one or more text response fields. The attacker must then deliver that file to a legitimate user, typically through social engineering such as email attachments or shared collaboration channels. When the victim imports the file into the Supplier Response Web Tool and clicks 'Next', the embedded script executes with the privileges of the user's browser session on the tool. Because the vector is local and requires active user interaction, mass exploitation is not feasible; the flaw is best characterized as a targeted phishing-enabled XSS.

No public proof-of-concept exploit code is available for CVE-2025-67634. See the CISA Vulnerability Assessment Report for the authoritative technical description.

Detection Methods for CVE-2025-67634

Indicators of Compromise

JSON files delivered to supplier personnel containing script tags, javascript: URIs, or event-handler attributes (for example onerror, onload) inside response text fields
Unexpected outbound browser requests from users of the Software Acquisition Guide tool immediately after clicking 'Next' during a supplier response session
Presence of imported JSON artifacts in user download or email attachment folders with non-standard text content in response fields

Detection Strategies

Inspect any JSON files intended for import into the Supplier Response Web Tool for HTML or JavaScript syntax within string values before opening them
Monitor browser console logs and network telemetry on workstations used for supplier response submissions for anomalous script execution
Apply email and file gateway content inspection rules that flag JSON attachments containing <script, onerror=, or similar XSS payload signatures

Monitoring Recommendations

Log and review all imports into the Supplier Response Web Tool for the workstations of personnel involved in federal software acquisition responses
Alert on browser-based script execution originating from CISA acquisition tooling pages that references external domains
Track user awareness training completion for suppliers responsible for handling acquisition JSON files

How to Mitigate CVE-2025-67634

Immediate Actions Required

Use only the current CISA-hosted version of the Software Acquisition Guide Supplier Response Web Tool dated 2025-12-11 or later
Do not import JSON files received from untrusted or unverified sources into the tool
Verify the integrity and origin of any JSON supplier response file before importing, ideally by inspecting the file in a plain text editor

Patch Information

CISA remediated the vulnerability in the version of the Supplier Response Web Tool published on 2025-12-11. Because the tool is hosted by CISA, users should ensure they access the tool directly from the official CISA Software Acquisition Tool page rather than cached or mirrored copies. Refer to the CVE-2025-67634 Record for authoritative fix metadata.

Workarounds

Manually re-enter supplier response data instead of importing JSON files when the source cannot be fully trusted
Perform JSON imports only within an isolated browser profile or sandboxed workstation that has no access to sensitive credentials or sessions
Restrict use of the tool to personnel who have completed training on identifying malicious file attachments

bash

# Configuration example: inspect a JSON supplier response file for XSS payloads before import
grep -Ei '<script|javascript:|onerror=|onload=|onclick=' supplier_response.json && \
  echo 'WARNING: potential XSS payload detected - do not import' || \
  echo 'No obvious script payloads found - proceed with caution'