{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_security_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR"}},"lang":"en","notes":[{"category":"summary","text":"grundschutz-oscal-viewer 1.6.37 is a feature, tooling and documentation release on top of the 1.6.36 line. Per the CHANGELOG [1.6.37] it adds a hand-curated TISAX (VDA ISA) 2027 crosswalk pack (77 controls, shipped as a runtime --mappings-dir pack); a new, rerunnable CISO Assistant mapping-pack generator (scripts/generate_ciso_mappings/ — 139 of 156 frameworks matched, ~181k rows) with 45 hypothesis property/fuzz tests that found and fixed 4 malformed-input crashes in that OFFLINE generator tooling; switches the markuplint quality gate to the Askama-aware @markuplint/nunjucks-parser (151 false findings -> 0), which surfaced four genuine template accessibility / HTML-validity fixes; adjusts the framework toggle defaults (GitHub Security Controls now off; EU AI Act, ISO 42001 and IEC 62443 now on); and wires the Playwright browser E2E suite into quality_gates.sh with expanded mapping-toggle coverage. None of these introduce or fix a vulnerability in the shipped viewer."},{"category":"description","text":"This advisory announces the 1.6.37 cut, published to crates.io and GitLab (tag v1.6.37). 1.6.37 collects no scored findings — unlike the 1.6.36 bug-hunt, every change here is a feature, a development-tooling robustness improvement, an accessibility / HTML-validity fix, or a documentation update, none of which changes the shipped viewer's security posture. The 4 crashes fixed by the new hypothesis property/fuzz tests are in scripts/generate_ciso_mappings/ — an OFFLINE, developer-run Python generator that is neither embedded in the binary nor reachable from any runtime input path of the viewer — so they carry zero security impact for deployed installations (they hardened the generator against malformed CISO Assistant YAML / GitHub tree-API JSON / data/frameworks.csv rows: the classic dict.get(key, default) gotcha where the default only applies when the key is absent, fixed with one _as_str() coercion helper). The four template fixes are accessibility / HTML-validity only — an explicit <img> width/height (layout-shift), deferred scripts, a <form> moved out of a <span>, and a menu-label <h6> changed to a <div class=\"dropdown-header\"> to stop a heading-level skip. The framework default change (GitHub Security Controls off; EU AI Act, ISO 42001, IEC 62443 on) is a UX default only. The running viewer's default-secure posture (127.0.0.1 bind, TLS 1.3 only, no authentication, single-operator local tool) is unchanged. The announcement itself introduces no vulnerability and requires no score beyond 0.0 / NONE."},{"category":"details","text":"Change set: data/frameworks.csv (new tisax-vda-isa-2027 slug + adjusted default_enabled flags), import/vda-isa-2027-mappings.csv (the hand-built 77-control TISAX 2027 crosswalk), scripts/generate_ciso_mappings/ (the download / matching / extraction / embedding generator plus 45 offline pytest + hypothesis tests), .markuplintrc.yaml (nunjucks parser + documented rule scoping for HTMX hx-*, Askama conditional attributes and Bootstrap tablist/switch ARIA), src/templates/{layouts/base.html, pages/annotations.html, pages/export.html, partials/nav_right.html} (the four a11y / HTML-validity fixes), src/frameworks.rs + tests/test_routes.rs (default-set assertions updated to match the new defaults), test/playwright/tests/settings-frameworks.spec.ts (single / All / None / Reset toggle coverage), scripts/quality_gates.sh (the playwright gate), scripts/release_pipeline.sh (RP_SKIP_VERIFY default), CHANGELOG and the README / LIESMICH / LISEZMOI framework-catalog section, plus this announcement. Verification (1.6.37): cargo fmt --check, cargo clippy --workspace --all-targets --all-features -D warnings, cargo test --workspace --all-features (265 lib tests plus every integration suite, including the all-998-controls render test), markuplint 0 findings with the nunjucks parser, htmlhint + oxlint clean, and the Playwright mapping-toggle suite (5/5 on chromium against a --seed-demo release build) all pass. 1.6.37 ships six cross-compiled binaries (x86_64/aarch64 linux-musl, x86_64/aarch64 windows, x86_64/aarch64 macOS) plus SHA256SUMS on the GitLab release."},{"category":"general","text":"Recommended action: upgrade via `cargo binstall grundschutz-oscal-viewer` (prebuilt GitLab release binary) or `cargo install grundschutz-oscal-viewer`. No configuration change is required. Operators who want the broad Grundschutz++ <-> framework crosswalks can now generate a --mappings-dir pack reproducibly with scripts/generate_ciso_mappings/ (the output is AGPLv3-derived data, loaded at runtime, never embedded). Note the framework-default change: a fresh embedded (no --mappings-dir) build now opens with no visible mapping rows until a toggle is enabled, since the only framework carrying embedded data (GitHub Security Controls) is now off by default."},{"category":"other","text":"CVSS applicability: this announcement is scored CVSS v3.1 0.0 (NONE) and v4.0 0.0 (NONE) — it is a feature / tooling / documentation release rollup, not a newly disclosed vulnerability, and it collects no scored findings. The 4 crashes fixed by the new hypothesis property/fuzz tests are in the offline scripts/generate_ciso_mappings/ generator, outside the shipped viewer's attack surface, and carry no CVSS. Status: final."},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","issuing_authority":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory in CSAF 2.1 format","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/csaf/2026/224/ndaal-sa-2026-224.json"},{"category":"external","summary":"CHANGELOG (1.6.37 section)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/CHANGELOG.md"},{"category":"external","summary":"grundschutz-oscal-viewer on crates.io","url":"https://crates.io/crates/grundschutz-oscal-viewer"},{"category":"external","summary":"ndaal_public_bsi_grundschutz_oscal_viewer repository","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer"},{"category":"external","summary":"GitLab release v1.6.37","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/releases/v1.6.37"},{"category":"external","summary":"Framework mappings pack (documentation)","url":"https://gitlab.com/vPierre/ndaal_public_bsi_grundschutz_oscal_viewer/-/raw/main/documentation/framework_mappings_pack.md"}],"title":"grundschutz-oscal-viewer 1.6.37 — TISAX 2027 pack + CISO mapping-pack generator + markuplint/a11y hardening + framework default changes; no new vulnerability","tracking":{"current_release_date":"2026-07-06T00:00:00.000Z","generator":{"engine":{"name":"ndaal CSAF Generator","version":"1.0.0"}},"id":"ndaal-sa-2026-224","initial_release_date":"2026-07-06T00:00:00.000Z","revision_history":[{"date":"2026-07-06T00:00:00.000Z","number":"1.0.0","summary":"Initial advisory: 1.6.37 feature / tooling / documentation release announcement. CVSS v3.1 0.0 / v4.0 0.0 (NONE). Status: final."}],"status":"final","version":"1.0.0"}},"product_tree":{"branches":[{"category":"vendor","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG","branches":[{"category":"product_name","name":"grundschutz-oscal-viewer","branches":[{"category":"product_version_range","name":"vers:cargo/<1.6.37","product":{"name":"grundschutz-oscal-viewer before 1.6.37.","product_id":"CSAFPID-0001"}},{"category":"product_version","name":"1.6.37","product":{"name":"grundschutz-oscal-viewer 1.6.37 — feature / tooling cut.","product_id":"CSAFPID-0002"}}]}]}]},"vulnerabilities":[{"notes":[{"category":"description","text":"This advisory announces the 1.6.37 cut, published to crates.io and GitLab (tag v1.6.37). 1.6.37 collects no scored findings — unlike the 1.6.36 bug-hunt, every change here is a feature, a development-tooling robustness improvement, an accessibility / HTML-validity fix, or a documentation update, none of which changes the shipped viewer's security posture. The 4 crashes fixed by the new hypothesis property/fuzz tests are in scripts/generate_ciso_mappings/ — an OFFLINE, developer-run Python generator that is neither embedded in the binary nor reachable from any runtime input path of the viewer — so they carry zero security impact for deployed installations (they hardened the generator against malformed CISO Assistant YAML / GitHub tree-API JSON / data/frameworks.csv rows: the classic dict.get(key, default) gotcha where the default only applies when the key is absent, fixed with one _as_str() coercion helper). The four template fixes are accessibility / HTML-validity only — an explicit <img> width/height (layout-shift), deferred scripts, a <form> moved out of a <span>, and a menu-label <h6> changed to a <div class=\"dropdown-header\"> to stop a heading-level skip. The framework default change (GitHub Security Controls off; EU AI Act, ISO 42001, IEC 62443 on) is a UX default only. The running viewer's default-secure posture (127.0.0.1 bind, TLS 1.3 only, no authentication, single-operator local tool) is unchanged. The announcement itself introduces no vulnerability and requires no score beyond 0.0 / NONE."},{"category":"details","text":"Change set: data/frameworks.csv (new tisax-vda-isa-2027 slug + adjusted default_enabled flags), import/vda-isa-2027-mappings.csv (the hand-built 77-control TISAX 2027 crosswalk), scripts/generate_ciso_mappings/ (the download / matching / extraction / embedding generator plus 45 offline pytest + hypothesis tests), .markuplintrc.yaml (nunjucks parser + documented rule scoping for HTMX hx-*, Askama conditional attributes and Bootstrap tablist/switch ARIA), src/templates/{layouts/base.html, pages/annotations.html, pages/export.html, partials/nav_right.html} (the four a11y / HTML-validity fixes), src/frameworks.rs + tests/test_routes.rs (default-set assertions updated to match the new defaults), test/playwright/tests/settings-frameworks.spec.ts (single / All / None / Reset toggle coverage), scripts/quality_gates.sh (the playwright gate), scripts/release_pipeline.sh (RP_SKIP_VERIFY default), CHANGELOG and the README / LIESMICH / LISEZMOI framework-catalog section, plus this announcement. Verification (1.6.37): cargo fmt --check, cargo clippy --workspace --all-targets --all-features -D warnings, cargo test --workspace --all-features (265 lib tests plus every integration suite, including the all-998-controls render test), markuplint 0 findings with the nunjucks parser, htmlhint + oxlint clean, and the Playwright mapping-toggle suite (5/5 on chromium against a --seed-demo release build) all pass. 1.6.37 ships six cross-compiled binaries (x86_64/aarch64 linux-musl, x86_64/aarch64 windows, x86_64/aarch64 macOS) plus SHA256SUMS on the GitLab release."}],"product_status":{"known_affected":["CSAFPID-0001"],"fixed":["CSAFPID-0002"]},"remediations":[{"category":"vendor_fix","details":"Upgrade to grundschutz-oscal-viewer 1.6.37 (CSAFPID-0002).","product_ids":["CSAFPID-0002"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0002"]}],"threats":[{"category":"impact","details":"No security impact from the release itself (CVSS 0.0 / NONE); 1.6.37 collects no scored findings — the malformed-input crashes it fixes are in the offline scripts/generate_ciso_mappings/ generator, outside the shipped viewer's attack surface."}],"title":"grundschutz-oscal-viewer 1.6.37 release — feature / tooling cut, no new vulnerability"}]}