DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-91127: CVE-2026-91127: DOM Cross-Site Scripting via Unsafe Hyperlink Schemes in Flyfish File Viewer Legacy DOC Renderer

#security #cve #cybersecurity

CVE-2026-91127: DOM Cross-Site Scripting via Unsafe Hyperlink Schemes in Flyfish File Viewer Legacy DOC Renderer

Vulnerability ID: CVE-2026-91127
CVSS Score: 8.2
Published: 2026-09-18

This report details CVE-2026-91127 (GHSA-3753-m2x2-q623), a high-severity DOM Cross-Site Scripting (DOM XSS) vulnerability in the file-viewer workspace developed by flyfish-dev. The legacy Word document (.doc) parser fails to restrict hyperlink URI schemes when rendering extracted document targets into generated HTML. As a result, a remote attacker can construct a malicious legacy DOC file containing scripts inside hyperlink properties. When a user previews the file and clicks the hyperlink, arbitrary JavaScript executes in the context of the hosting origin, enabling session hijacking, credential theft, or unauthorized API interaction.

TL;DR

The legacy DOC file parser in Flyfish File Viewer fails to sanitize hyperlink schemes before injecting them into anchor tags. Under typical execution flows, an attacker can embed malicious javascript: or vbscript: URIs into document links, executing arbitrary script in the host application's origin upon user click. This high-severity flaw (CVSS 8.2) is remediated in package versions starting with @file-viewer/doc 2.3.1.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79, CWE-83
  • Attack Vector: Network (AV:N)
  • CVSS Score: 8.2 (High)
  • EPSS Score: N/A
  • Impact: DOM Cross-Site Scripting (DOM XSS)
  • Exploit Status: PoC (Proof-of-Concept)
  • KEV Status: Not listed

Affected Systems

  • flyfish-dev file-viewer (workspace integration)
  • @file-viewer/doc
  • msdoc-viewer
  • @file-viewer/renderer-word
  • @file-viewer/preset-all
  • @file-viewer/preset-office
  • @file-viewer/vue3-full
  • @file-viewer/react-full
  • @file-viewer/web-full
  • @file-viewer/doc: < 2.3.1 (Fixed in: 2.3.1)
  • msdoc-viewer: < 0.2.2 (Fixed in: 0.2.2)
  • @file-viewer/renderer-word: < 2.3.2 (Fixed in: 2.3.2)
  • @file-viewer/preset-all: < 2.3.4 (Fixed in: 2.3.4)

Code Analysis

Commit: ef04568

DOMPurify 3.4.13 integration, scheme validation, sanitizeMsDocLinkHref helper creation

Mitigation Strategies

  • Upgrade @file-viewer/doc to 2.3.1 or higher
  • Implement strict Content Security Policy (CSP) blocking inline execution
  • Restrict or disable preview options for legacy .doc formats, allowing download-only access.

Remediation Steps:

  1. Identify all occurrences of flyfish-dev viewer packages in workspace dependencies.
  2. Run pnpm add @file-viewer/vue3-full@2.3.4 or the corresponding package target.
  3. Validate dependencies lockfile to confirm no nested packages use vulnerable versions.
  4. Deploy strict CSP headers targeting host origins.

References

Read the full report for CVE-2026-91127 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)