Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.2
CVE-2026-91127: File Viewer can run scripts via crafted DOC links
CVE-2026-91127 · published 1 month ago
Summary
The legacy DOC renderer in File Viewer (msdoc-viewer and @file-viewer/doc) could turn specially crafted document links into executable scripts such as JavaScript when a user clicked them. This could let an attacker run code in the context of your web application. Update to the latest versions (2.3.1 for @file-viewer/doc and 0.2.2 for msdoc-viewer) or ensure external links are blocked.
What to do
- Update msdoc-viewer to version 0.2.2.
- Update file-viewer @file-viewer/doc to version 2.3.1.
- Update file-viewer doc to version 2.3.1.
- Update GitHub Actions msdoc-viewer to version 0.2.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | – | msdoc-viewer |
<= 0.2.1 < 0.2.2 Fix: upgrade to 0.2.2
|
| npm | file-viewer | @file-viewer/doc |
< 2.3.1 Fix: upgrade to 2.3.1
|
| – | flyfish-dev | file-viewer | < 2.3.1 |
| – | @file-viewer | doc | < 2.3.1 |
| – | flyfish-dev | msdoc-viewer | < 0.2.2 |
| npm | file-viewer | doc |
<= 2.3.0 Fix: upgrade to 2.3.1
|
| npm | GitHub Actions | msdoc-viewer |
<= 0.2.1 Fix: upgrade to 0.2.2
|
Original advisory text
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escaping but without restricting URL schemes. A crafted legacy DOC file could place javascript:, vbscript:, data:, or another unsafe scheme in a rendered link, and script could execute in the embedding application's origin when a user clicked the link. The fix blocks external document links by default, allows only HTTP(S), mail, telephone, safe relative URLs, and internal bookmarks when external links are explicitly enabled, and applies mount-boundary sanitization as defense in depth. This issue is fixed in @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2.
References
- https://github.com/flyfish-dev/file-viewer/security/advisories/GHSA-3753-m2x2-q6... Vendor Advisory
- https://github.com/advisories/GHSA-3753-m2x2-q623
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91127... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-91127 Vendor Advisory
- https://github.com/flyfish-dev/file-viewer/releases/tag/v2.3.1 URL
- https://github.com/flyfish-dev/file-viewer Product
- https://github.com/flyfish-dev/file-viewer/commit/ef045680f8d9830a3eee9612f7df46... Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
CWE-83Improper Neutralization of Script in Attributes in a Web Page
Timeline
Published18 Sep 2026
Updated4 Nov 2026
First seen18 Sep 2026
Sources
CVE-2026-91127 · NVD
CVE-2026-91127 · MITRE
GHSA-3753-m2x2-q623 · GHSA
CVE-2026-91127 · OSV
GHSA-3753-m2x2-q623 · OSV
Track software like this
Free during beta