Social Security Administration - CraftedSignal Threat Feed

Social Security Administration genesys: Supply chain dependency on compromised polyfill.io domain (CVE-2026-104375)

hello@craftedsignal.io — Tue, 10 Nov 2026 19:00:28 +0000

The Social Security Administration (SSA) genesys toolkit and the vendored Mavo v0.2.0 library contain hardcoded references to cdn.polyfill.io. This domain was sold to a hostile third party in February 2024 and has been observed serving malicious payloads, including redirects to phishing and scam sites. While the SSA demo page itself does not process user sessions or sensitive data, the toolkit is documented for use in production-ready user interfaces, creating a significant supply-chain risk for any application inheriting this dependency. The vulnerability is tracked as CVE-2026-104375. The repository was updated on 2026-09-17 to remove these references.

Impact

Downstream applications utilizing the genesys toolkit or Mavo v0.2.0 are susceptible to arbitrary JavaScript injection via the hostile-controlled polyfill domain. Successful exploitation would allow attackers to execute malicious code within the context of the user's browser, enabling potential credential theft or redirection to fraudulent websites.

Recommendation

Audit all applications and prototypes derived from the genesys toolkit or Mavo v0.2.0 to identify and remove references to cdn.polyfill.io.
Replace any dynamic script loading mechanisms that point to external, unverified CDNs with local hosting or trusted, static mirrors.
Upgrade any projects using the genesys toolkit to the version released after 2026-09-17.
Monitor web traffic logs for requests directed at cdn.polyfill.io or googie-anaiytics.com originating from web application frontends.

Social Security Administration dce-web: Multiple Vulnerabilities (CVE-2026-104371, CVE-2026-104372, CVE-2026-104373)

hello@craftedsignal.io — Tue, 10 Nov 2026 19:00:09 +0000

The Social Security Administration (SSA) 'dce-web' application was found to contain three security vulnerabilities discovered via internal audit. While the repository was decommissioned on September 18, 2026, the findings highlight risks associated with legacy build processes and configuration.

CVE-2026-104371: Bootstrap CSS files were loaded from a CDN without subresource integrity (SRI), enabling potential CSS injection, UI redressing, or phishing within the dashboard.
CVE-2026-104372: The project lacked a lockfile and used outdated build dependencies (2016-2017), rendering automated software composition analysis (SCA) ineffective and exposing developer environments to known vulnerabilities like WebSocket origin check bypasses and ReDoS.
CVE-2026-104373: Build scripts (gulpfile.js) contained hardcoded internal SSA SMB/UNC network paths, facilitating internal network reconnaissance.

Recommendation

Verify that the 'dce-web' repository and any associated build environments have been fully decommissioned as per the reported remediation date of September 18, 2026.
Conduct a review of legacy repositories to identify and remediate hardcoded internal network paths, especially within build configurations or deployment scripts.
Implement mandatory Subresource Integrity (SRI) for all third-party resources loaded in web applications to prevent content tampering.
Enforce the use of lockfiles (e.g., package-lock.json, yarn.lock) in all development projects to ensure reproducible builds and allow for accurate, ongoing SCA vulnerability scanning.