Eigenpal docx-editor CSS injection and print-time XSS via font-family

Executive brief

The @eigenpal/docx-editor React component parses Word documents (.docx files) and displays them in web applications. An attacker can craft a malicious Word document that injects CSS on page load (enabling overlay attacks, data exfiltration, and phishing) and execute arbitrary JavaScript when a user clicks Print. This compromises user data and allows account takeover in the context of the embedding application.

Technical details

This is a CSS injection and cross-site scripting (XSS) vulnerability stemming from improper handling of font-family names embedded in Word document metadata (word/fontTable.xml). Font names are unescaped when interpolated directly into @font-face CSS rules and into the print window via document.write(). An attacker can break out of the CSS context and inject arbitrary HTML/JavaScript by crafting a malicious font name. The attack requires only that a user open the crafted .docx file (no interaction needed for CSS injection); JavaScript execution on Print requires the additional step of the user clicking the Print button. The vulnerability affects versions ≤ 1.8.2 of both @eigenpal/docx-editor-core and @eigenpal/docx-editor-react. The fix in version 1.8.3 implements CSS escaping for special characters (quotes, backslash, angle brackets, newlines) and replaces document.write() with DOM APIs for assembling the print window.

Affected products

• eigenpal @eigenpal/docx-editor-core ≤ 1.8.2
• eigenpal @eigenpal/docx-editor-react ≤ 1.8.2

Timeline

• 2026-09-10: disclosed: Advisory published to GitHub Advisory Database
• 2026-09-10: patched: Patched versions 1.8.3 released

References

• https://api.github.com/users/samcorcos
• https://github.com/samcorcos
• https://api.github.com/users/samcorcos/gists%7B/gist_id%7D
• https://api.github.com/users/samcorcos/repos
• https://avatars.githubusercontent.com/u/2626231?v=4
• https://api.github.com/users/samcorcos/events%7B/privacy%7D