Skip to content
CVE IDCVE-2026-91127GitHub advisory IDGHSA-3753-m2x2-q623

File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer

CVE-2026-91127 (GitHub advisory GHSA-3753-m2x2-q623) is a high-severity vulnerability with a CVSS 3.1 base score of 8.2, classed as Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79), in @file-viewer/doc (npm) and msdoc-viewer (npm). Fixed versions: @file-viewer/doc 2.3.1; msdoc-viewer 0.2.2.

High8.2Fix availableGitHub reviewed

Published 18 Sept 2026Updated 18 Sept 2026

8.2HighCVSS 3.1
CVE ID
CVE-2026-91127
GHSA ID
GHSA-3753-m2x2-q623
EPSS
0.23%higher than 14% of CVEs
Weaknesses (CWE)
  • CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-83Improper Neutralization of Script in Attributes in a Web Page
KEV status
Not in KEV
Published
18 Sept 2026
Updated
18 Sept 2026
Ecosystem
  • npm
Assigned by (CNA)
GitHub_M

Summary

Source: OSV (GitHub advisory)

Before 2.3.1, the legacy .doc renderer emitted document hyperlink targets after HTML escaping but without a URL-scheme allowlist. A crafted .doc could therefore render a live javascript:, vbscript:, data:, or similarly unsafe link. Script could execute in the embedding origin if a viewer clicked it.

Impact

Applications rendering untrusted legacy .doc files with @file-viewer/doc or the msdoc-viewer compatibility package could expose their origin to attacker-controlled script after link interaction.

Fix

Version 2.3.1 centralizes link handling, removes control-character and scheme confusion, blocks external document links by default, and in explicit allow mode accepts only HTTP(S), mail, telephone, safe relative URLs, and internal bookmarks. The renderer output is safe before mounting, with mount-boundary sanitization as defense in depth. The msdoc-viewer compatibility release containing the fix is 0.2.2.

Thanks to @shashank420 for responsibly reporting this issue.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

High8.2Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Privileges Required PR
None
User Interaction UI
Required
Scope S
Changed
Confidentiality C
High
Integrity I
Low
Availability A
None

Affected packages

Source: OSV (GitHub advisory)

  • @file-viewer/doc
    npm
    pkg:npm/%40file-viewer/doc
    Affected versions
    <= 2.3.0
    Fixed in
    2.3.1
  • msdoc-viewer
    npm
    pkg:npm/msdoc-viewer
    Affected versions
    <= 0.2.1
    Fixed in
    0.2.2

Fix

Source: OSV (GitHub advisory)

Fix available

  • @file-viewer/doc: upgrade to 2.3.1 or later
  • msdoc-viewer: upgrade to 0.2.2 or later

Patch commits

  • ef04568Patch commitgithub.com/flyfish-dev/file-viewer

    fix(security): harden legacy DOC rendering boundaries

    +847 −427 across 30 files

    • CHANGELOG.md+17 −0
    • README.en.md+2 −2
    • README.md+2 −2
    • README.zh-CN.md+5 −5
    • SECURITY.md+2 −1
    • apps/official-site/en/index.html+4 −4
    • apps/official-site/index.html+4 −4
    • apps/official-site/package.json+1 −1
    • and 22 more files

Vulnerability intelligence

References

Credits

Questions about CVE-2026-91127

What is the GHSA ID for CVE-2026-91127?
GitHub tracks CVE-2026-91127 as GHSA-3753-m2x2-q623.
What is the CVSS score of CVE-2026-91127?
CVE-2026-91127 has a CVSS 3.1 base score of 8.2 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N.
Which versions are affected by CVE-2026-91127?
@file-viewer/doc (npm): <= 2.3.0. msdoc-viewer (npm): <= 0.2.1.
How do I fix CVE-2026-91127?
Upgrade each package to its fixed version: @file-viewer/doc 2.3.1; msdoc-viewer 0.2.2. The fix is in commit ef04568.
What is the Package URL (PURL) for CVE-2026-91127?
The affected packages' PURLs are pkg:npm/%40file-viewer/doc and pkg:npm/msdoc-viewer.
Is CVE-2026-91127 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-91127. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 14% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 2 days ago (13 Oct 2026, 13:22 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.