{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mavo-v0.2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-104375"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["genesys (\u003c= 2026-09-17)","Mavo (v0.2.0)"],"_cs_severities":["high"],"_cs_tags":["supply-chain","cve-2026-104375","javascript-injection"],"_cs_type":"advisory","_cs_vendors":["Social Security Administration"],"content_html":"\u003cp\u003eThe Social Security Administration (SSA) genesys toolkit and the vendored Mavo v0.2.0 library contain hardcoded references to \u003ccode\u003ecdn.polyfill.io\u003c/code\u003e. This domain was sold to a hostile third party in February 2024 and has been observed serving malicious payloads, including redirects to phishing and scam sites. While the SSA demo page itself does not process user sessions or sensitive data, the toolkit is documented for use in production-ready user interfaces, creating a significant supply-chain risk for any application inheriting this dependency. The vulnerability is tracked as CVE-2026-104375. The repository was updated on 2026-09-17 to remove these references.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eDownstream applications utilizing the genesys toolkit or Mavo v0.2.0 are susceptible to arbitrary JavaScript injection via the hostile-controlled polyfill domain. Successful exploitation would allow attackers to execute malicious code within the context of the user's browser, enabling potential credential theft or redirection to fraudulent websites.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit all applications and prototypes derived from the genesys toolkit or Mavo v0.2.0 to identify and remove references to \u003ccode\u003ecdn.polyfill.io\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eReplace any dynamic script loading mechanisms that point to external, unverified CDNs with local hosting or trusted, static mirrors.\u003c/li\u003e\n\u003cli\u003eUpgrade any projects using the genesys toolkit to the version released after 2026-09-17.\u003c/li\u003e\n\u003cli\u003eMonitor web traffic logs for requests directed at \u003ccode\u003ecdn.polyfill.io\u003c/code\u003e or \u003ccode\u003egoogie-anaiytics.com\u003c/code\u003e originating from web application frontends.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T19:00:28Z","date_published":"2026-11-10T19:00:28Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ssa-genesys/","summary":"The Social Security Administration genesys toolkit and the bundled Mavo v0.2.0 library contain hardcoded references to the hostile-owned cdn.polyfill.io domain, posing a supply-chain risk of malicious script injection into downstream applications.","title":"Social Security Administration genesys: Supply chain dependency on compromised polyfill.io domain (CVE-2026-104375)","url":"https://feed.craftedsignal.io/briefs/2026-11-ssa-genesys/"}],"language":"en","title":"CraftedSignal Threat Feed - Mavo (V0.2.0)","version":"https://jsonfeed.org/version/1.1"}