Description
Embedded font-family names (word/fontTable.xml) were interpolated unescaped into an injected @font-face <style> and into the print window’s document.write(). A crafted name injects page-wide CSS on open, and breaks out of <style> into executable HTML on Print.
Recommendation
Update the @eigenpal/docx-editor-react package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.8.2
- Patched version(s): 1.8.3
References
Could your website be exposed too?
SmartScanner can check your website for @eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name and gives you actionable findings to investigate.
Start a free scanRelated Issues
- xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the - CVE-2026-83609
- Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check - CVE-2026-31860
- PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel - Vulnerability
- PostCSS has XSS via Unescaped </style> in its CSS Stringify Output - CVE-2026-41305
You might also like:
See something that needs correcting? Let us knowUpdated September 10, 2026