Doc
Monthly
The legacy DOC renderer in File Viewer emits document-controlled hyperlink targets into generated HTML after character escaping but without restricting URL schemes, so a crafted legacy .doc file can render a live javascript:, vbscript:, or data: link and execute script in the embedding application's origin when a user clicks it. Applications are affected if they use @file-viewer/doc up to and including 2.3.0 or the msdoc-viewer compatibility package up to and including 0.2.1 to render untrusted .doc files; exploitation is conditionally gated, requiring a victim to open the preview and click the malicious link (CVSS 8.2, UI:R, scope changed). No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-released fixes exist in @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2.
The legacy DOC renderer in File Viewer emits document-controlled hyperlink targets into generated HTML after character escaping but without restricting URL schemes, so a crafted legacy .doc file can render a live javascript:, vbscript:, or data: link and execute script in the embedding application's origin when a user clicks it. Applications are affected if they use @file-viewer/doc up to and including 2.3.0 or the msdoc-viewer compatibility package up to and including 0.2.1 to render untrusted .doc files; exploitation is conditionally gated, requiring a victim to open the preview and click the malicious link (CVSS 8.2, UI:R, scope changed). No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-released fixes exist in @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2.