High, CVSS 8.8npmAmendedPublished
OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document
CVE-2026-118670 · GHSA-xwgp-w3pj-q5h3
- Affected
- npm @ohif/extension-dicom-pdf >= 3.5.0-beta.0, < 3.12.18; >= 3.13.0-beta.0, < 3.13.10; >= 3.14.0-beta.0, < 3.14.0-beta.36
- Fixed in
- 3.13.103.14.0-beta.363.12.18· Vendor fix available
- Issue
- An XSS (Cross-Site Scripting) vulnerability occurs when an attacker is able to inject their own JavaScript code into a web page's source, which is subsequently processed by the victim's browser. A common cause of this vulnerability is the failure to validate user-supplied data before displaying it within the vulnerable application without proper filtering. To exploit the vulnerability, an attacker must input HTML code into a vulnerable parameter containing structures that trigger the execution of JavaScript. The DOM XSS variant occurs when user-supplied data is processed by a client-side script; if this data is not handled correctly by the script itself, it becomes possible to inject additional JavaScript commands. Attacker model: Any actor who can get a DICOM object in front of a victim — email a `.dcm` for local viewing, upload to a shared PACS, or operate/compromise a DICOMweb source. Preconditions: Victim opens a study whose SOP Class is Encapsulated PDF…
Recommended action: Upgrade to 3.14.0-beta.36 (pre-release), 3.13.10 or 3.12.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.