CISA Software Acquisition Guide Supplier Response Web Tool Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability has been identified in the CISA Software Acquisition Guide Supplier Response Web Tool, affecting versions prior to December 11, 2025. The issue arises from text fields that allow the injection of malicious JavaScript. If an attacker convinces a user to import a specially-crafted JSON file, the Tool will execute the embedded JavaScript in the context of the user's browser when the page is submitted.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected JavaScript is executed in the user's browser, potentially leading to session hijacking or other malicious actions.