Medium severity · published Dec 12, 2025
CVE-2025-67634
Software Acquisition Guide Supplier Response Web Tool XSS
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-crafted JSON file, the Tool would load JavaScript from the file into the page. The JavaScript would execute in the context of the user's browser when the user submits the page (clicks 'Next').
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Software Acquisition Guide Tool · CISA
before 2025-12-11 · source: vendor
SA
Software Acquisition Guide · Cisa
before 2025-12-11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-67634
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-67634
Vendor Advisory
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-345-01.json
Product
https://www.cisa.gov/software-acquisition-guide/tool
Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2025-67634