Executive brief
@eigenpal/docx-editor-react is a React library for editing Microsoft Word documents. A vulnerability in how font names are processed allows attackers to inject malicious CSS into documents that execute automatically when opened, and escalate to script execution when a user prints the document. This could enable phishing attacks, data theft, or account compromise.
Technical details
The vulnerability is a CSS injection and cross-site scripting (XSS) issue in font-family name handling. Embedded font names from the word/fontTable.xml file in .docx documents are interpolated unescaped into injected @font-face <style> tags and into the print window's document.write() calls. An attacker can craft a malicious .docx with a specially-crafted font name to inject arbitrary CSS that applies page-wide on document open (requiring only user interaction to open the file), and can break out of the <style> context into executable HTML when the user initiates a print operation. The fix in version 1.8.3 CSS-escapes font names before interpolation and replaces document.write() with safer DOM APIs.
Affected products
- eigenpal @eigenpal/docx-editor-react < 1.8.3
- eigenpal @eigenpal/docx-editor-core < 1.8.3
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Fixed in version 1.8.3