Vulnerability · Published Dec 12, 2025 · Assigned by cisa-cg

CVE-2025-67634Software Acquisition Guide Supplier Response Web Tool XSS

Medium 4.4

In plain English

A medium-severity cross-site scripting in Software Acquisition Guide Tool from CISA. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)4.4Medium

Exploit odds (30 days)0.2%top 91.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-crafted JSON file, the Tool would load JavaScript from the file into the page. The JavaScript would execute in the context of the user's browser when the user submits the page (clicks 'Next').

Affected products (as reported)

Vendor	Product	Versions
CISA	Software Acquisition Guide Tool	0 – before 2025-12-11

Weakness: CWE-79 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

url product
url government-resource, third-party-advisory
url