NPM: File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer

NPM: File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer vulnerability discovered by ? in WordPress Npm msdoc-viewer versions = 0.2.1...

File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer

Summary Before 2.3.1, the legacy .doc renderer emitted document hyperlink targets after HTML escaping but without a URL-scheme allowlist. A crafted .doc could therefore render a live javascript:, vbscript:, data:, or similarly unsafe link. Script could execute in the embedding origin if a viewer...

CVE-2026-91127 File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer

File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escapin...

EUVD-2026-83206

File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escapin...

CVE-2026-91127

File Viewer 's legacy DOC renderer in @file-viewer/doc (< 2.3.1) and msdoc-viewer (

Mozilla: Fullscreen notification obscured

The Mozilla Foundation Security Advisory describes this flaw as: A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks...