CVE-2026-118670

OHIF Viewers is affected by a DOM-Based Cross Site Scripting (XSS) vulnerability in the dicom-pdf extension (versions 3.5.0-beta.0 through 3.12.15, 3.13.7, and 3.14.0-beta.19). The root cause is that the extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/di...