EUVD-2026-83206
GHSA-3753-m2x2-q623
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Unauthenticated remote (PR:N/AV:N), but victim must click the malicious link (UI:R); script escapes render context into host origin (S:C) enabling data theft (C:H) and limited tampering (I:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6Blast Radius
ecosystem impact- 12 npm packages depend on @file-viewer/doc (2 direct, 10 indirect)
Ecosystem-wide dependent count for version 2.3.1.
DescriptionCVE.org
File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escaping but without restricting URL schemes. A crafted legacy DOC file could place javascript:, vbscript:, data:, or another unsafe scheme in a rendered link, and script could execute in the embedding application's origin when a user clicked the link. The fix blocks external document links by default, allows only HTTP(S), mail, telephone, safe relative URLs, and internal bookmarks when external links are explicitly enabled, and applies mount-boundary sanitization as defense in depth. This issue is fixed in @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2.
AnalysisAI
The legacy DOC renderer in File Viewer emits document-controlled hyperlink targets into generated HTML after character escaping but without restricting URL schemes, so a crafted legacy .doc file can render a live javascript:, vbscript:, or data: link and execute script in the embedding application's origin when a user clicks it. Applications are affected if they use @file-viewer/doc up to and including 2.3.0 or the msdoc-viewer compatibility package up to and including 0.2.1 to render untrusted .doc files; exploitation is conditionally gated, requiring a victim to open the preview and click the malicious link (CVSS 8.2, UI:R, scope changed). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the embedding application uses @file-viewer/doc ≤2.3.0 or msdoc-viewer ≤0.2.1 to render UNTRUSTED legacy .doc files, and that a user opens the preview and CLICKS an attacker-controlled hyperlink (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditionally-gated client-side XSS (CWE-79) rather than a mass-exploitable network flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the vendor-released fixed versions: @file-viewer/doc 2.3.1, msdoc-viewer 0.2.2, and @file-viewer/renderer-word 2.3.2, or the 2.3.4 patch line for the Office/Full/copy-assets bundles (for example pnpm add @file-viewer/vue3-full@2.3.4); the fix commit is https://github.com/flyfish-dev/file-viewer/commit/ef045680f8d9830a3eee9612f7df46a734361b07 and details are in the GHSA-3753-m2x2-q623 advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications and services using @file-viewer/doc up to and including 2.3.0 or msdoc-viewer up to and including 0.2.1 to render untrusted .doc files, disable or tightly restrict legacy .doc previews where business use is not essential, and block javascript:, vbscript:, and data: hyperlink schemes in rendered documents via sanitization or a strict Content Security Policy. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in pack
DNS rebinding against the local Streamable HTTP MCP listener in @zereight/mcp-gitlab before 2.1.30 lets a malicious web
Archive extraction in the Node.js decompress package allows a crafted archive containing chained symlink entries to reso
Untrusted git configuration includes reachable through simple-git before 4.0.0 let an attacker execute arbitrary command
A remote, unauthenticated denial-of-service condition in the NestJS (Nest) microservices framework lets an attacker cras
Deeply nested brace patterns cause unbounded recursion in the npm brace-expansion library, exhausting the native stack a
Stack exhaustion in the npm library brace-expansion (all versions prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10) lets a craf
The JavaScript library ip-address (npm) fails to treat the NAT64 local-use prefix 64:ff9b:1::/48 as private, so applicat
Cross-family subnet comparisons in the ip-address npm library (all versions before 10.7.1) can cause isInSubnet and isHo
Denial of service in the ip-address JavaScript/npm library (all versions prior to 10.7.1) lets remote attackers stall or
A credential-isolation flaw in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker who controls or can pred
Code injection in orval's opt-in @orval/hono generator (all versions before 8.29.0) lets an attacker who controls an Ope
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today