Edit ndaal-sa-2026-224

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

This advisory announces the 1.6.37 cut, published to crates.io and GitLab (tag v1.6.37). 1.6.37 collects no scored findings — unlike the 1.6.36 bug-hunt, every change here is a feature, a development-tooling robustness improvement, an accessibility / HTML-validity fix, or a documentation update, none of which changes the shipped viewer's security posture. The 4 crashes fixed by the new hypothesis property/fuzz tests are in scripts/generate_ciso_mappings/ — an OFFLINE, developer-run Python generator that is neither embedded in the binary nor reachable from any runtime input path of the viewer — so they carry zero security impact for deployed installations (they hardened the generator against malformed CISO Assistant YAML / GitHub tree-API JSON / data/frameworks.csv rows: the classic dict.get(key, default) gotcha where the default only applies when the key is absent, fixed with one _as_str() coercion helper). The four template fixes are accessibility / HTML-validity only — an explicit <img> width/height (layout-shift), deferred scripts, a <form> moved out of a <span>, and a menu-label <h6> changed to a <div class="dropdown-header"> to stop a heading-level skip. The framework default change (GitHub Security Controls off; EU AI Act, ISO 42001, IEC 62443 on) is a UX default only. The running viewer's default-secure posture (127.0.0.1 bind, TLS 1.3 only, no authentication, single-operator local tool) is unchanged. The announcement itself introduces no vulnerability and requires no score beyond 0.0 / NONE.

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel