CVE-2026-30691 Overview
CVE-2026-30691 is a Cross-Site Scripting (XSS) vulnerability affecting @cyntler/react-doc-viewer version 1.17.1. The flaw resides in the TXTRenderer component, which fails to sanitize file content before rendering. The component explicitly casts raw file data as a ReactNode, allowing remote attackers to execute arbitrary JavaScript by supplying a crafted .txt file. Exploitation requires user interaction, typically opening or previewing the malicious document within an application that embeds the vulnerable viewer. The vulnerability is tracked under [CWE-79] and impacts the confidentiality and integrity of user sessions in applications using the affected package.
Critical Impact
Attackers can execute arbitrary JavaScript in the victim's browser context by tricking users into loading a crafted .txt file through applications embedding the vulnerable TXTRenderer component.
Affected Products
- @cyntler/react-doc-viewer version 1.17.1
- Web applications embedding the TXTRenderer component from this package
- Downstream projects depending on the vulnerable npm package
Discovery Timeline
- 2026-05-20 - CVE-2026-30691 published to NVD
- 2026-05-20 - Last updated in NVD database
Technical Details for CVE-2026-30691
Vulnerability Analysis
The @cyntler/react-doc-viewer library renders multiple document formats inside React applications. The TXTRenderer component handles plain text files but treats file content as trusted output. Instead of escaping or sanitizing the raw bytes, the component casts the input directly as a ReactNode. React normally escapes string children, but the explicit cast bypasses safe rendering paths, allowing embedded HTML and script content to reach the DOM.
The issue is a classic client-side injection (XSS) flaw [CWE-79]. The attack scope changes because injected scripts run within the parent application's origin, granting access to cookies, tokens, and DOM state belonging to other components. Exploitation does not require authentication, but user interaction is necessary to load the malicious file in the viewer.
Root Cause
The root cause is unsafe type coercion in the TXTRenderer component. By casting unsanitized file contents to ReactNode, the developer overrode React's default string-escaping behavior. Any HTML markup, including <script> tags or event handler attributes inside the file, becomes active markup at render time. No content sanitization library or output encoding is applied before rendering.
Attack Vector
An attacker crafts a .txt file containing HTML or JavaScript payloads. The victim opens or previews the file within a web application using the vulnerable viewer component. The injected payload executes in the browser under the application's origin. Delivery methods include file uploads in document management platforms, email attachments rendered in webmail previews, or shared links pointing to attacker-controlled files. See the GitHub Issue Discussion and the public proof-of-concept repository for technical details.
No verified exploit code is reproduced here. The mechanism follows standard reflected and stored XSS patterns where unsanitized file content reaches the DOM through a type-cast bypass of React's escaping.
Detection Methods for CVE-2026-30691
Indicators of Compromise
- Uploaded .txt files containing <script> tags, javascript: URIs, or HTML event handler attributes such as onerror or onload.
- Browser console errors or unexpected outbound requests originating from pages that render documents via @cyntler/react-doc-viewer.
- Session token exfiltration attempts following user interaction with text documents in the affected application.
Detection Strategies
- Inventory project dependencies and identify any use of @cyntler/react-doc-viewer at version 1.17.1 or earlier through package.json and lockfile review.
- Inspect server-side logs for uploaded text files containing HTML markup or script tags prior to viewer rendering.
- Deploy Content Security Policy (CSP) violation reporting to capture inline script execution attempts originating from document viewers.
Monitoring Recommendations
- Monitor web application logs for anomalous JavaScript execution and unexpected DOM modifications on pages embedding the document viewer.
- Alert on outbound network requests from authenticated user sessions immediately following document preview actions.
- Track Software Composition Analysis (SCA) findings for the affected npm package across continuous integration pipelines.
How to Mitigate CVE-2026-30691
Immediate Actions Required
- Upgrade @cyntler/react-doc-viewer to a patched release once published by the maintainer, or pin to a non-vulnerable fork.
- Sanitize text file contents server-side before passing them to the viewer using a library such as DOMPurify or strict HTML entity encoding.
- Restrict file upload acceptance to validated text content and reject files containing HTML markup or control characters.
Patch Information
At the time of publication, no official patched version is referenced in the NVD entry. Track the upstream GitHub Issue Discussion for remediation status. Until a fix is released, applications must apply compensating controls described in the workarounds section.
Workarounds
- Disable or replace the TXTRenderer component with a custom renderer that explicitly escapes file content using React's default string rendering rather than ReactNode casting.
- Implement a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins.
- Render untrusted text files inside a sandboxed iframe with the sandbox attribute set to block script execution.
# Example CSP header to mitigate inline script execution
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
