@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-79.
Summary
## Summary Embedded font-family names (`word/fontTable.xml`) were interpolated unescaped into an injected `@font-face` `<style>` and into the print window's `document.write()`. A crafted name injects page-wide CSS on open, and breaks out of `<style>` into executable HTML on Print. ## Impact Opening a crafted `.docx` applies attacker-controlled CSS page-wide with zero clicks (overlay/phishing, attribute-selector exfiltration of input values, tracking beacons). Clicking Print escalates to script execution in the embedder's origin. ## Remediation Upgrade to 1.8.3. Font names are CSS-escaped before interpolation (quotes, backslash, `< >`, and CSS newlines), and the print window is assembled with DOM APIs instead of `document.write`.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | @eigenpal/docx-editor-core (npm) | before 1.8.3 | 1.8.3 | Patch available | GHSA-x7m8-jrm8-hpvx |
| — | @eigenpal/docx-editor-react (npm) | before 1.8.3 | 1.8.3 | Patch available | GHSA-x7m8-jrm8-hpvx |
- @eigenpal/docx-editor-core (npm) Vendor— Affected before 1.8.3 Fixed in 1.8.3 Patch available GHSA-x7m8-jrm8-hpvx
- @eigenpal/docx-editor-react (npm) Vendor— Affected before 1.8.3 Fixed in 1.8.3 Patch available GHSA-x7m8-jrm8-hpvx
Remediation
- Fix · GHSA-x7m8-jrm8-hpvx @eigenpal/docx-editor-core (npm) Fixed in 1.8.3 Advisory →
- Fix · GHSA-x7m8-jrm8-hpvx @eigenpal/docx-editor-react (npm) Fixed in 1.8.3 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-x7m8-jrm8-hpvx
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences