CVE-2026-118670 OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document

OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it...

CVE-2026-118670

OHIF Viewers is affected by a DOM-Based Cross Site Scripting (XSS) vulnerability in the dicom-pdf extension (versions 3.5.0-beta.0 through 3.12.15, 3.13.7, and 3.14.0-beta.19). The root cause is that the extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/di...

EUVD-2026-118385

OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it...