Description
Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt file. The TXTRenderer component fails to sanitize file content and explicitly casts raw data as a ReactNode.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 1.17.1
References
Could your website be exposed too?
SmartScanner can check your website for @cyntler/react-doc-viewer's TXTRenderer fails to sanitize file content and explicitly casts raw data as a ReactNode and gives you actionable findings to investigate.
Start a free scanRelated Issues
- sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, pos - CVE-2026-53606
- Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` - CVE-2026-44990
- Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
- Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark - CVE-2026-45058
You might also like:
See something that needs correcting? Let us knowUpdated June 11, 2026