Read the docs
TI-2026-61897 Aliases CVE-2026-91127GHSA-3753-m2x2-q623

File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer

Priority LOW 36CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escaping but without restricting URL schemes. A crafted legacy DOC file could place javascript:, vbscript:, data:, or another unsafe scheme in a rendered link, and script could execute in the embedding application's origin when a user clicked the link. The fix blocks external document links by default, allows only HTTP(S), mail, telephone, safe relative URLs, and internal bookmarks when external links are explicitly enabled, and applies mount-boundary sanitization as defense in depth. This issue is fixed in @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00397 34th percentileScored 2026-11-07
Fix Fixed file-viewer (flyfish-dev): 2.3.1doc (@file-viewer): 2.3.1+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
flyfish-devfile-viewerbefore 2.3.12.3.1Patch availableCNA
@file-viewerdocbefore 2.3.12.3.1Patch availableCNA
flyfish-devmsdoc-viewerbefore 0.2.20.2.2Patch availableCNA
—@file-viewer/doc (npm)before 2.3.12.3.1Patch availableGHSA-3753-m2x2-q623
—msdoc-viewer (npm)before 0.2.20.2.2Patch availableGHSA-3753-m2x2-q623
  • file-viewer Vendorflyfish-dev Affected before 2.3.1 Fixed in 2.3.1 Patch available CNA
  • doc Vendor@file-viewer Affected before 2.3.1 Fixed in 2.3.1 Patch available CNA
  • msdoc-viewer Vendorflyfish-dev Affected before 0.2.2 Fixed in 0.2.2 Patch available CNA
  • @file-viewer/doc (npm) Vendor— Affected before 2.3.1 Fixed in 2.3.1 Patch available GHSA-3753-m2x2-q623
  • msdoc-viewer (npm) Vendor— Affected before 0.2.2 Fixed in 0.2.2 Patch available GHSA-3753-m2x2-q623

Remediation

  • Fix · CNA file-viewer (flyfish-dev) Fixed in 2.3.1
  • Fix · CNA doc (@file-viewer) Fixed in 2.3.1
  • Fix · CNA msdoc-viewer (flyfish-dev) Fixed in 0.2.2
  • Fix · GHSA-3753-m2x2-q623 @file-viewer/doc (npm) Fixed in 2.3.1 Advisory →
  • Fix · GHSA-3753-m2x2-q623 msdoc-viewer (npm) Fixed in 0.2.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-91127
  2. 2026-10-03 Alias added: GHSA-3753-m2x2-q623

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences