Description
Before 2.3.1, the legacy .doc renderer emitted document hyperlink targets after HTML escaping but without a URL-scheme allowlist. A crafted .doc could therefore render a live javascript:, vbscript:, data:, or similarly unsafe link. Script could execute in the embedding origin if a viewer clicked it.
Recommendation
Update the @file-viewer/doc package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.3.0
- Patched version(s): 2.3.1
References
Could your website be exposed too?
SmartScanner can check your website for File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer and gives you actionable findings to investigate.
Start a free scanRelated Issues
- wetty vulnerable to DOM XSS via file-download filename - CVE-2026-49864
- i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes - CVE-2026-41692
- dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration - CVE-2026-34725
- Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State - CVE-2026-42573
You might also like:
See something that needs correcting? Let us knowUpdated September 18, 2026