CISA’s secure-software buying tool had a simple XSS vulnerability of its own

#### Executive summary — CISA's Software Acquisition Guide: Supplier Response Web Tool contained a cross-site scripting (XSS) vulnerability that was reported in September and patched in December; there is no evidence of known exploitation, and the agency followed coordinated disclosure procedures to create a CVE and apply a fix.