Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@eigenpal/docx-editor-core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1npmAmendedPublished

    @eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name

    GHSA-x7m8-jrm8-hpvx

    Affected
    • npm @eigenpal/docx-editor-core <= 1.8.2
    Fixed in
    1.8.3· Vendor fix available
    Issue
    Embedded font-family names (word/fontTable.xml) were interpolated unescaped into an injected @font-face <style and into the print window's document.write(). A crafted name injects page-wide CSS on open, and breaks out of <style into executable HTML on Print. Impact Opening a crafted .docx applies attacker-controlled CSS page-wide with zero clicks (overlay/phishing, attribute-selector exfiltration of input values, tracking beacons). Clicking Print escalates to script execution in the embedder's origin. Remediation Upgrade to 1.8.3. Font names are CSS-escaped before interpolation (quotes, backslash, < , and CSS newlines), and the print window is assembled with DOM APIs instead of document.write.

    Recommended action: Upgrade to 1.8.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →