{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/social-security-administration/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-104375"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["genesys (\u003c= 2026-09-17)","Mavo (v0.2.0)"],"_cs_severities":["high"],"_cs_tags":["supply-chain","cve-2026-104375","javascript-injection"],"_cs_type":"advisory","_cs_vendors":["Social Security Administration"],"content_html":"\u003cp\u003eThe Social Security Administration (SSA) genesys toolkit and the vendored Mavo v0.2.0 library contain hardcoded references to \u003ccode\u003ecdn.polyfill.io\u003c/code\u003e. This domain was sold to a hostile third party in February 2024 and has been observed serving malicious payloads, including redirects to phishing and scam sites. While the SSA demo page itself does not process user sessions or sensitive data, the toolkit is documented for use in production-ready user interfaces, creating a significant supply-chain risk for any application inheriting this dependency. The vulnerability is tracked as CVE-2026-104375. The repository was updated on 2026-09-17 to remove these references.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eDownstream applications utilizing the genesys toolkit or Mavo v0.2.0 are susceptible to arbitrary JavaScript injection via the hostile-controlled polyfill domain. Successful exploitation would allow attackers to execute malicious code within the context of the user's browser, enabling potential credential theft or redirection to fraudulent websites.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit all applications and prototypes derived from the genesys toolkit or Mavo v0.2.0 to identify and remove references to \u003ccode\u003ecdn.polyfill.io\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eReplace any dynamic script loading mechanisms that point to external, unverified CDNs with local hosting or trusted, static mirrors.\u003c/li\u003e\n\u003cli\u003eUpgrade any projects using the genesys toolkit to the version released after 2026-09-17.\u003c/li\u003e\n\u003cli\u003eMonitor web traffic logs for requests directed at \u003ccode\u003ecdn.polyfill.io\u003c/code\u003e or \u003ccode\u003egoogie-anaiytics.com\u003c/code\u003e originating from web application frontends.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T19:00:28Z","date_published":"2026-11-10T19:00:28Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ssa-genesys/","summary":"The Social Security Administration genesys toolkit and the bundled Mavo v0.2.0 library contain hardcoded references to the hostile-owned cdn.polyfill.io domain, posing a supply-chain risk of malicious script injection into downstream applications.","title":"Social Security Administration genesys: Supply chain dependency on compromised polyfill.io domain (CVE-2026-104375)","url":"https://feed.craftedsignal.io/briefs/2026-11-ssa-genesys/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ssa:dce-web:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-104371"},{"id":"CVE-2026-104372"},{"id":"CVE-2026-104373"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["dce-web"],"_cs_severities":["low"],"_cs_tags":["web-vulnerability","supply-chain","information-disclosure","cisa"],"_cs_type":"advisory","_cs_vendors":["Social Security Administration"],"content_html":"\u003cp\u003eThe Social Security Administration (SSA) 'dce-web' application was found to contain three security vulnerabilities discovered via internal audit. While the repository was decommissioned on September 18, 2026, the findings highlight risks associated with legacy build processes and configuration.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-104371: Bootstrap CSS files were loaded from a CDN without subresource integrity (SRI), enabling potential CSS injection, UI redressing, or phishing within the dashboard.\u003c/li\u003e\n\u003cli\u003eCVE-2026-104372: The project lacked a lockfile and used outdated build dependencies (2016-2017), rendering automated software composition analysis (SCA) ineffective and exposing developer environments to known vulnerabilities like WebSocket origin check bypasses and ReDoS.\u003c/li\u003e\n\u003cli\u003eCVE-2026-104373: Build scripts (\u003ccode\u003egulpfile.js\u003c/code\u003e) contained hardcoded internal SSA SMB/UNC network paths, facilitating internal network reconnaissance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eVerify that the 'dce-web' repository and any associated build environments have been fully decommissioned as per the reported remediation date of September 18, 2026.\u003c/li\u003e\n\u003cli\u003eConduct a review of legacy repositories to identify and remediate hardcoded internal network paths, especially within build configurations or deployment scripts.\u003c/li\u003e\n\u003cli\u003eImplement mandatory Subresource Integrity (SRI) for all third-party resources loaded in web applications to prevent content tampering.\u003c/li\u003e\n\u003cli\u003eEnforce the use of lockfiles (e.g., \u003ccode\u003epackage-lock.json\u003c/code\u003e, \u003ccode\u003eyarn.lock\u003c/code\u003e) in all development projects to ensure reproducible builds and allow for accurate, ongoing SCA vulnerability scanning.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T19:00:09Z","date_published":"2026-11-10T19:00:09Z","id":"https://feed.craftedsignal.io/briefs/2026-11-dce-web-vulnerabilities/","summary":"The decommissioned dce-web application contained vulnerabilities involving missing Subresource Integrity (CVE-2026-104371), supply chain risks from unpinned development dependencies (CVE-2026-104372), and internal SMB path exposure (CVE-2026-104373).","title":"Social Security Administration dce-web: Multiple Vulnerabilities (CVE-2026-104371, CVE-2026-104372, CVE-2026-104373)","url":"https://feed.craftedsignal.io/briefs/2026-11-dce-web-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - Social Security Administration","version":"https://jsonfeed.org/version/1.1"}