Executive brief
File Viewer is a browser-based document renderer supporting Office, PDF, and other formats. The legacy .doc parser failed to validate hyperlink URL schemes, allowing attackers to embed executable javascript:, vbscript:, or data: schemes in crafted .doc files. When a user clicks such a link, arbitrary script executes in the application's security context, potentially exposing sensitive data or compromising the application. The vulnerability is fixed in version 2.3.1 with URL scheme allowlisting and mount-boundary sanitization.
Technical details
The vulnerability is a DOM XSS (CWE-79, CWE-83) in the legacy .doc renderer of the File Viewer library. The root cause is improper hyperlink handling: the renderer applied HTML entity encoding but failed to restrict unsafe URL schemes such as javascript:, vbscript:, data:, and others before inserting hyperlink targets into the DOM. Attack vector is network; an attacker crafts a malicious .doc file containing dangerous hyperlinks and convinces a user to open it in an application using @file-viewer/doc or msdoc-viewer. User interaction (clicking the link) is required for code execution. The scope is changed (impacting the embedding application's origin). Fix version 2.3.1 centralizes link handling, implements URL scheme allowlisting (accepting only HTTP(S), mailto, tel, safe relative URLs, and internal bookmarks), blocks external document links by default, and adds defense-in-depth sanitization at the mount boundary using DOMPurify 3.4.13 before content enters the DOM.
Affected products
- flyfish-dev @file-viewer/doc <= 2.3.0
- flyfish-dev msdoc-viewer <= 0.2.1
Timeline
- 2026-09-18: disclosed: GHSA advisory published
- 2026-08-24: patched: Fix version 2.3.1 released for @file-viewer/doc and 0.2.2 for msdoc-viewer