Raw JSON
{
"$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.1",
"distribution": {
"tlp": {
"label": "CLEAR"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "grundschutz-oscal-viewer 1.6.37 is a feature, tooling and documentation release on top of the 1.6.36 line. Per the CHANGELOG [1.6.37] it adds a hand-curated TISAX (VDA ISA) 2027 crosswalk pack (77 controls, shipped as a runtime --mappings-dir pack); a new, rerunnable CISO Assistant mapping-pack generator (scripts/generate_ciso_mappings/ — 139 of 156 frameworks matched, ~181k rows) with 45 hypothesis property/fuzz tests that found and fixed 4 malformed-input crashes in that OFFLINE generator tooling; switches the markuplint quality gate to the Askama-aware @markuplint/nunjucks-parser (151 false findings -> 0), which surfaced four genuine template accessibility / HTML-validity fixes; adjusts the framework toggle defaults (GitHub Security Controls now off; EU AI Act, ISO 42001 and IEC 62443 now on); and wires the Playwright browser E2E suite into quality_gates.sh with expanded mapping-toggle coverage. None of these introduce or fix a vulnerability in the shipped viewer."
},
{
"category": "description",
"text": "This advisory announces the 1.6.37 cut, published to crates.io and GitLab (tag v1.6.37). 1.6.37 collects no scored findings — unlike the 1.6.36 bug-hunt, every change here is a feature, a development-tooling robustness improvement, an accessibility / HTML-validity fix, or a documentation update, none of which changes the shipped viewer's security posture. The 4 crashes fixed by the new hypothesis property/fuzz tests are in scripts/generate_ciso_mappings/ — an OFFLINE, developer-run Python generator that is neither embedded in the binary nor reachable from any runtime input path of the viewer — so they carry zero security impact for deployed installations (they hardened the generator against malformed CISO Assistant YAML / GitHub tree-API JSON / data/frameworks.csv rows: the classic dict.get(key, default) gotcha where the default only applies when the key is absent, fixed with one _as_str() coercion helper). The four template fixes are accessibility / HTML-validity only — an explicit <img> width/height (layout-shift), deferred scripts, a <form> moved out of a <span>, and a menu-label <h6> changed to a <div class=\"dropdown-header\"> to stop a heading-level skip. The framework default change (GitHub Security Controls off; EU AI Act, ISO 42001, IEC 62443 on) is a UX default only. The running viewer's default-secure posture (127.0.0.1 bind, TLS 1.3 only, no authentication, single-operator local tool) is unchanged. The announcement itself introduces no vulnerability and requires no score beyond 0.0 / NONE."
},
{
"category": "details",
"text": "Change set: data/frameworks.csv (new tisax-vda-isa-2027 slug + adjusted default_enabled flags), import/vda-isa-2027-mappings.csv (the hand-built 77-control TISAX 2027 crosswalk), scripts/generate_ciso_mappings/ (the download / matching / extraction / embedding generator plus 45 offline pytest + hypothesis tests), .markuplintrc.yaml (nunjucks parser + documented rule scoping for HTMX hx-*, Askama conditional attributes and Bootstrap tablist/switch ARIA), src/templates/{layouts/base.html, pages/annotations.html, pages/export.html, partials/nav_right.html} (the four a11y / HTML-validity fixes), src/frameworks.rs + tests/test_routes.rs (default-set assertions updated to match the new defaults), test/playwright/tests/settings-frameworks.spec.ts (single / All / None / Reset toggle coverage), scripts/quality_gates.sh (the playwright gate), scripts/release_pipeline.sh (RP_SKIP_VERIFY default), CHANGELOG and the README / LIESMICH / LISEZMOI framework-catalog section, plus this announcement. Verification (1.6.37): cargo fmt --check, cargo clippy --workspace --all-targets --all-features -D warnings, cargo test --workspace --all-features (265 lib tests plus every integration suite, including the all-998-controls render test), markuplint 0 findings with the nunjucks parser, htmlhint + oxlint clean, and the Playwright mapping-toggle suite (5/5 on chromium against a --seed-demo release build) all pass. 1.6.37 ships six cross-compiled binaries (x86_64/aarch64 linux-musl, x86_64/aarch64 windows, x86_64/aarch64 macOS) plus SHA256SUMS on the GitLab release."
},
{
"category": "general",
"text": "Recommended action: upgrade via `cargo binstall grundschutz-oscal-viewer` (prebuilt GitLab release binary) or `cargo install grundschutz-oscal-viewer`. No configuration change is required. Operators who want the broad Grundschutz++ <-> framework crosswalks can now generate a --mappings-dir pack reproducibly with scripts/generate_ciso_mappings/ (the output is AGPLv3-derived data, loaded at runtime, never embedded). Note the framework-default change: a fresh embedded (no --mappings-dir) build now opens with no visible mapping rows until a toggle is enabled, since the only framework carrying embedded data (GitHub Security Controls) is now off by default."
},
{
"category": "other",
"text": "CVSS applicability: this announcement is scored CVSS v3.1 0.0 (NONE) and v4.0 0.0 (NONE) — it is a feature / tooling / documentation release rollup, not a newly disclosed vulnerability, and it collects no scored findings. The 4 crashes fixed by the new hypothesis property/fuzz tests are in the offline scripts/generate_ciso_mappings/ generator, outside the shipped viewer's attack surface, and carry no CVSS. Status: final."
},
{
"category": "legal_disclaimer",
"text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."
}
],
"publisher": {
"category": "vendor",
"contact_details": "security@ndaal.eu",
"issuing_authority": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team",
"name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG",
"namespace": "https://ndaal.eu/csaf"
},
"references": [
{
"category": "self",
"summary": "This advisory in CSAF 2.1 format",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/224/ndaal-sa-2026-224.json"
},
{
"category": "external",
"summary": "CHANGELOG (1.6.37 section)",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/CHANGELOG.md"
},
{
"category": "external",
"summary": "grundschutz-oscal-viewer on crates.io",
"url": "https://crates.io/crates/grundschutz-oscal-viewer"
},
{
"category": "external",
"summary": "ndaal_public_bsi_grundschutz_oscal_viewer repository",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer"
},
{
"category": "external",
"summary": "GitLab release v1.6.37",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/releases/v1.6.37"
},
{
"category": "external",
"summary": "Framework mappings pack (documentation)",
"url": "https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/documentation/framework_mappings_pack.md"
}
],
"title": "grundschutz-oscal-viewer 1.6.37 — TISAX 2027 pack + CISO mapping-pack generator + markuplint/a11y hardening + framework default changes; no new vulnerability",
"tracking": {
"current_release_date": "2026-07-06T00:00:00.000Z",
"generator": {
"engine": {
"name": "ndaal CSAF Generator",
"version": "1.0.0"
}
},
"id": "ndaal-sa-2026-224",
"initial_release_date": "2026-07-06T00:00:00.000Z",
"revision_history": [
{
"date": "2026-07-06T00:00:00.000Z",
"number": "1.0.0",
"summary": "Initial advisory: 1.6.37 feature / tooling / documentation release announcement. CVSS v3.1 0.0 / v4.0 0.0 (NONE). Status: final."
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"category": "vendor",
"name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG",
"branches": [
{
"category": "product_name",
"name": "grundschutz-oscal-viewer",
"branches": [
{
"category": "product_version_range",
"name": "vers:cargo/<1.6.37",
"product": {
"name": "grundschutz-oscal-viewer before 1.6.37.",
"product_id": "CSAFPID-0001"
}
},
{
"category": "product_version",
"name": "1.6.37",
"product": {
"name": "grundschutz-oscal-viewer 1.6.37 — feature / tooling cut.",
"product_id": "CSAFPID-0002"
}
}
]
}
]
}
]
},
"vulnerabilities": [
{
"notes": [
{
"category": "description",
"text": "This advisory announces the 1.6.37 cut, published to crates.io and GitLab (tag v1.6.37). 1.6.37 collects no scored findings — unlike the 1.6.36 bug-hunt, every change here is a feature, a development-tooling robustness improvement, an accessibility / HTML-validity fix, or a documentation update, none of which changes the shipped viewer's security posture. The 4 crashes fixed by the new hypothesis property/fuzz tests are in scripts/generate_ciso_mappings/ — an OFFLINE, developer-run Python generator that is neither embedded in the binary nor reachable from any runtime input path of the viewer — so they carry zero security impact for deployed installations (they hardened the generator against malformed CISO Assistant YAML / GitHub tree-API JSON / data/frameworks.csv rows: the classic dict.get(key, default) gotcha where the default only applies when the key is absent, fixed with one _as_str() coercion helper). The four template fixes are accessibility / HTML-validity only — an explicit <img> width/height (layout-shift), deferred scripts, a <form> moved out of a <span>, and a menu-label <h6> changed to a <div class=\"dropdown-header\"> to stop a heading-level skip. The framework default change (GitHub Security Controls off; EU AI Act, ISO 42001, IEC 62443 on) is a UX default only. The running viewer's default-secure posture (127.0.0.1 bind, TLS 1.3 only, no authentication, single-operator local tool) is unchanged. The announcement itself introduces no vulnerability and requires no score beyond 0.0 / NONE."
},
{
"category": "details",
"text": "Change set: data/frameworks.csv (new tisax-vda-isa-2027 slug + adjusted default_enabled flags), import/vda-isa-2027-mappings.csv (the hand-built 77-control TISAX 2027 crosswalk), scripts/generate_ciso_mappings/ (the download / matching / extraction / embedding generator plus 45 offline pytest + hypothesis tests), .markuplintrc.yaml (nunjucks parser + documented rule scoping for HTMX hx-*, Askama conditional attributes and Bootstrap tablist/switch ARIA), src/templates/{layouts/base.html, pages/annotations.html, pages/export.html, partials/nav_right.html} (the four a11y / HTML-validity fixes), src/frameworks.rs + tests/test_routes.rs (default-set assertions updated to match the new defaults), test/playwright/tests/settings-frameworks.spec.ts (single / All / None / Reset toggle coverage), scripts/quality_gates.sh (the playwright gate), scripts/release_pipeline.sh (RP_SKIP_VERIFY default), CHANGELOG and the README / LIESMICH / LISEZMOI framework-catalog section, plus this announcement. Verification (1.6.37): cargo fmt --check, cargo clippy --workspace --all-targets --all-features -D warnings, cargo test --workspace --all-features (265 lib tests plus every integration suite, including the all-998-controls render test), markuplint 0 findings with the nunjucks parser, htmlhint + oxlint clean, and the Playwright mapping-toggle suite (5/5 on chromium against a --seed-demo release build) all pass. 1.6.37 ships six cross-compiled binaries (x86_64/aarch64 linux-musl, x86_64/aarch64 windows, x86_64/aarch64 macOS) plus SHA256SUMS on the GitLab release."
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
],
"fixed": [
"CSAFPID-0002"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Upgrade to grundschutz-oscal-viewer 1.6.37 (CSAFPID-0002).",
"product_ids": [
"CSAFPID-0002"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0002"
]
}
],
"threats": [
{
"category": "impact",
"details": "No security impact from the release itself (CVSS 0.0 / NONE); 1.6.37 collects no scored findings — the malformed-input crashes it fixes are in the offline scripts/generate_ciso_mappings/ generator, outside the shipped viewer's attack surface."
}
],
"title": "grundschutz-oscal-viewer 1.6.37 release — feature / tooling cut, no new vulnerability"
}
]
}