File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
Summary
Before 2.3.1, the legacy .doc renderer emitted document hyperlink targets after HTML escaping but without a URL-scheme allowlist. A crafted .doc could therefore render a live javascript:, vbscript:, data:, or similarly unsafe link. Script could execute in the embedding origin if a viewer clicked it.
Impact
Applications rendering untrusted legacy .doc files with @file-viewer/doc or the msdoc-viewer compatibility package could expose their origin to attacker-controlled script after link interaction.
Fix
Version 2.3.1 centralizes link handling, removes control-character and scheme confusion, blocks external document links by default, and in explicit allow mode accepts only HTTP(S), mail, telephone, safe relative URLs, and internal bookmarks. The renderer output is safe before mounting, with mount-boundary sanitization as defense in depth. The msdoc-viewer compatibility release containing the fix is 0.2.2.
Thanks to @shashank420 for responsibly reporting this issue.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @file-viewer/doc | < 2.3.1 | 2.3.1 |
| npm package | msdoc-viewer | < 0.2.2 | 0.2.2 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N- Weakness (CWE)
CWE-79, CWE-83- Platform
- npm
- Package
@file-viewer/doc, msdoc-viewer- Disclosed
- 18.09.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-3753-m2x2-q623 - CC BY 4.0
Vulnerability history: @file-viewer/doc
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.