{"id":"CVE-2026-118670","aliases":["EUVD-2026-118385","GHSA-xwgp-w3pj-q5h3"],"status":"published","title":"OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document","description":"OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it as the Blob media type for the attacker-controlled EncapsulatedDocument bytes. When a victim opens Encapsulated PDF SOP Class 1.2.840.10008.5.1.4.1.1.104.1, extensions/dicom-pdf/src/viewports/OHIFCornerstonePdfViewport.tsx embeds the Blob URL in an object element. A Blob labeled as HTML is handled as HTML despite the application/pdf object hint, and the Blob inherits the OHIF origin, allowing embedded script to access session storage, authentication tokens, and same-origin PACS requests. The malicious DICOM object may be opened locally, uploaded to a shared PACS, or supplied by a DICOMweb source. This issue is fixed in source versions 3.12.15, 3.13.7, and 3.14.0-beta.19.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-14","score":0.00421,"percentile":0.36916,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-11-06T17:29:15.266Z","modified":"2026-11-10T16:15:05Z","fixes":[{"ecosystem":"npm","package":"@ohif/extension-dicom-pdf","fixed_in":["3.12.18","3.13.10","3.14.0-beta.36"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@ohif/extension-dicom-pdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-beta.0"},{"fixed":"3.12.18"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@ohif/extension-dicom-pdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.13.0-beta.0"},{"fixed":"3.13.10"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@ohif/extension-dicom-pdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.14.0-beta.0"},{"fixed":"3.14.0-beta.36"}]}]},{"source":"osv","ecosystem":"npm","package":"@ohif/extension-dicom-pdf","ranges":[{"type":"SEMVER","events":[{"introduced":"3.5.0-beta.0"},{"fixed":"3.12.18"}]}]},{"source":"osv","ecosystem":"npm","package":"@ohif/extension-dicom-pdf","ranges":[{"type":"SEMVER","events":[{"introduced":"3.13.0-beta.0"},{"fixed":"3.13.10"}]}]},{"source":"osv","ecosystem":"npm","package":"@ohif/extension-dicom-pdf","ranges":[{"type":"SEMVER","events":[{"introduced":"3.14.0-beta.0"},{"fixed":"3.14.0-beta.36"}]}]}],"products":[{"vendor":"ohif","product":"viewers"}],"references":[{"url":"https://github.com/OHIF/Viewers/security/advisories/GHSA-xwgp-w3pj-q5h3","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/OHIF/Viewers/pull/6228","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/OHIF/Viewers/commit/db546701bd5f2be9031c835f1de5c40aacd3dc62","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/OHIF/Viewers/commit/ef0811c66cdb04ba07ffaba145cf66ce01486899","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/OHIF/Viewers/commit/f0dba789a313f40fe7e8a8cbec322a8d8a491d76","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/OHIF/Viewers/releases/tag/v3.12.15","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/OHIF/Viewers/releases/tag/v3.13.7","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/OHIF/Viewers/releases/tag/v3.14.0-beta.19","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118670","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xwgp-w3pj-q5h3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118670.json","tags":["advisory"]},{"url":"https://github.com/OHIF/Viewers","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-118670","title":"OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document","description":"OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it as the Blob media type for the attacker-controlled EncapsulatedDocument bytes. When a victim opens Encapsulated PDF SOP Class 1.2.840.10008.5.1.4.1.1.104.1, extensions/dicom-pdf/src/viewports/OHIFCornerstonePdfViewport.tsx embeds the Blob URL in an object element. A Blob labeled as HTML is handled as HTML despite the application/pdf object hint, and the Blob inherits the OHIF origin, allowing embedded script to access session storage, authentication tokens, and same-origin PACS requests. The malicious DICOM object may be opened locally, uploaded to a shared PACS, or supplied by a DICOMweb source. This issue is fixed in source versions 3.12.15, 3.13.7, and 3.14.0-beta.19.","status":"published","published":"2026-11-06T17:29:15.266Z","modified":"2026-11-06T17:47:50.262Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-06T18:59:07.714367Z"}],"euvd":[{"id":"EUVD-2026-118385","description":"OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document","status":"published","published":"2026-11-10T15:57:51Z","modified":"2026-11-10T15:57:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-10T17:21:44.229469Z"}],"ghsa":[{"id":"GHSA-xwgp-w3pj-q5h3","title":"OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document","description":"### Summary\nAn XSS (Cross-Site Scripting) vulnerability occurs when an attacker is able to inject their own JavaScript code into a web page's source, which is subsequently processed by the victim's browser. A common cause of this vulnerability is the failure to validate user-supplied data before displaying it within the vulnerable application without proper filtering. To exploit the vulnerability, an attacker must input HTML code into a vulnerable parameter containing structures that trigger the execution of JavaScript. The DOM XSS variant occurs when user-supplied data is processed by a client-side script; if this data is not handled correctly by the script itself, it becomes possible to inject additional JavaScript commands.\n\n**Attacker model:** Any actor who can get a DICOM object in front of a victim — email a `.dcm`\nfor local viewing, upload to a shared PACS, or operate/compromise a DICOMweb source.\n**Preconditions:** Victim opens a study whose SOP Class is Encapsulated PDF\n(`1.2.840.10008.5.1.4.1.1.104.1`) and OHIF's `dicom-pdf` extension renders it (default in the\nstandard modes).\n\n#### Taint path\n\n**Source** — two attacker-controlled tags on the encapsulated-document instance:\n- `MIMETypeOfEncapsulatedDocument` (0042,0012)\n- `EncapsulatedDocument` (0042,0011) — the raw document bytes\n\n`extensions/dicom-pdf/src/getSopClassHandlerModule.js:15,20` reads the MIME tag with no\nvalidation and passes it as `defaultType`:\n\n```js\nconst { SeriesDescription = 'PDF', MIMETypeOfEncapsulatedDocument } = instance;\n...\nconst renderedUrlParams = {\n  instance,\n  tag: 'EncapsulatedDocument',\n  defaultType: MIMETypeOfEncapsulatedDocument || 'application/pdf',  // attacker-controlled\n  singlepart: 'pdf',\n};\nconst renderedUrl = dataSource.retrieve.directURL(renderedUrlParams);\n```\n\n**Sink** — `defaultType` becomes the `Blob` type in all three retrieval paths:\n\n*Local file (no server required):* `extensions/default/src/DicomLocalDataSource/index.js:120-131`\n```js\ndirectURL: params =\u003e {\n  const { instance, tag, defaultType } = params;\n  const value = instance[tag];\n  if (value instanceof Array \u0026\u0026 value[0] instanceof ArrayBuffer) {\n    return URL.createObjectURL(new Blob([value[0]], { type: defaultType }));  // attacker MIME\n  }\n},\n```\n\n*DICOMweb InlineBinary:* `extensions/default/src/utils/getDirectURL.ts:40-44` →\n`platform/core/src/utils/b64toBlob.js:18`\n```js\nif (value.InlineBinary) {\n  const blob = utils.b64toBlob(value.InlineBinary, defaultType);   // -\u003e new Blob(..., { type: defaultType })\n  value.DirectRetrieveURL = URL.createObjectURL(blob);\n  return value.DirectRetrieveURL;\n}\n```\n\n*DICOMweb bulk data:* `extensions/default/src/utils/getDirectURL.ts:52-55`\n```js\nreturn value.retrieveBulkData(options).then(arr =\u003e {\n  value.DirectRetrieveURL = URL.createObjectURL(new Blob([arr], { type: defaultType }));\n  return value.DirectRetrieveURL;\n});\n```\n\n**Render** — `extensions/dicom-pdf/src/viewports/OHIFCornerstonePdfViewport.tsx:86-92`\n```tsx\n\u003cobject\n  data={url}                 {/* blob: URL whose stored MIME = attacker's MIMETypeOfEncapsulatedDocument */}\n  type=\"application/pdf\"     {/* only a hint; overridden by the blob's own Content-Type */}\n  className={style}\n\u003e\n```\n\n**Why it fires.** A `blob:` URL stores the MIME type passed at `new Blob(..., { type })`\nconstruction. When such a URL is navigated/embedded, the browser uses the blob's stored\nContent-Type to choose a handler; the `\u003cobject type=\"application/pdf\"\u003e` attribute is a\npre-load hint, not an override. A blob created with `type: 'text/html'` therefore renders as an\nHTML document, and because `blob:` URLs inherit the creating page's origin, any `\u003cscript\u003e` in it\nexecutes **in the OHIF origin** — with access to `localStorage`/`sessionStorage`, auth tokens,\nand same-origin requests to the PACS.\n\n### Impact\nUsers using the applications. If the application is behind authentication then session can be stolen. If on the same DNS name some other applications are hosted, they are also impacted.\n\n### Patches\n\nFixed in `@ohif/extension-dicom-pdf` `3.12.18`, `3.13.10` and `3.14.0-beta.36` (fix: https://github.com/OHIF/Viewers/pull/6228).\nIf you build OHIF from source, the fix first landed in tags `3.12.15`, `3.13.7` and `3.14.0-beta.19`.\nVersions `3.5` to `3.11` will not receive a fix. Upgrade to a patched `3.12`, `3.13` or `3.14` version.","status":"published","published":"2026-11-10T15:57:51Z","modified":"2026-11-10T15:57:54Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-10T16:25:10.795148Z"}],"nvd":[{"id":"CVE-2026-118670","description":"OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it as the Blob media type for the attacker-controlled EncapsulatedDocument bytes. When a victim opens Encapsulated PDF SOP Class 1.2.840.10008.5.1.4.1.1.104.1, extensions/dicom-pdf/src/viewports/OHIFCornerstonePdfViewport.tsx embeds the Blob URL in an object element. A Blob labeled as HTML is handled as HTML despite the application/pdf object hint, and the Blob inherits the OHIF origin, allowing embedded script to access session storage, authentication tokens, and same-origin PACS requests. The malicious DICOM object may be opened locally, uploaded to a shared PACS, or supplied by a DICOMweb source. This issue is fixed in source versions 3.12.15, 3.13.7, and 3.14.0-beta.19.","status":"published","published":"2026-11-06T18:17:57.34Z","modified":"2026-11-12T20:04:52.377Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-12T21:32:42.795748Z"}],"osv":[{"id":"CVE-2026-118670","title":"OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document","description":"OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it as the Blob media type for the attacker-controlled EncapsulatedDocument bytes. When a victim opens Encapsulated PDF SOP Class 1.2.840.10008.5.1.4.1.1.104.1, extensions/dicom-pdf/src/viewports/OHIFCornerstonePdfViewport.tsx embeds the Blob URL in an object element. A Blob labeled as HTML is handled as HTML despite the application/pdf object hint, and the Blob inherits the OHIF origin, allowing embedded script to access session storage, authentication tokens, and same-origin PACS requests. The malicious DICOM object may be opened locally, uploaded to a shared PACS, or supplied by a DICOMweb source. This issue is fixed in source versions 3.12.15, 3.13.7, and 3.14.0-beta.19.","status":"published","published":"2026-11-06T17:29:15.266Z","modified":"2026-11-14T02:30:22.810443323Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-08T02:57:19.626258Z"},{"id":"GHSA-xwgp-w3pj-q5h3","title":"OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document","description":"### Summary\nAn XSS (Cross-Site Scripting) vulnerability occurs when an attacker is able to inject their own JavaScript code into a web page's source, which is subsequently processed by the victim's browser. A common cause of this vulnerability is the failure to validate user-supplied data before displaying it within the vulnerable application without proper filtering. To exploit the vulnerability, an attacker must input HTML code into a vulnerable parameter containing structures that trigger the execution of JavaScript. The DOM XSS variant occurs when user-supplied data is processed by a client-side script; if this data is not handled correctly by the script itself, it becomes possible to inject additional JavaScript commands.\n\n**Attacker model:** Any actor who can get a DICOM object in front of a victim — email a `.dcm`\nfor local viewing, upload to a shared PACS, or operate/compromise a DICOMweb source.\n**Preconditions:** Victim opens a study whose SOP Class is Encapsulated PDF\n(`1.2.840.10008.5.1.4.1.1.104.1`) and OHIF's `dicom-pdf` extension renders it (default in the\nstandard modes).\n\n#### Taint path\n\n**Source** — two attacker-controlled tags on the encapsulated-document instance:\n- `MIMETypeOfEncapsulatedDocument` (0042,0012)\n- `EncapsulatedDocument` (0042,0011) — the raw document bytes\n\n`extensions/dicom-pdf/src/getSopClassHandlerModule.js:15,20` reads the MIME tag with no\nvalidation and passes it as `defaultType`:\n\n```js\nconst { SeriesDescription = 'PDF', MIMETypeOfEncapsulatedDocument } = instance;\n...\nconst renderedUrlParams = {\n  instance,\n  tag: 'EncapsulatedDocument',\n  defaultType: MIMETypeOfEncapsulatedDocument || 'application/pdf',  // attacker-controlled\n  singlepart: 'pdf',\n};\nconst renderedUrl = dataSource.retrieve.directURL(renderedUrlParams);\n```\n\n**Sink** — `defaultType` becomes the `Blob` type in all three retrieval paths:\n\n*Local file (no server required):* `extensions/default/src/DicomLocalDataSource/index.js:120-131`\n```js\ndirectURL: params =\u003e {\n  const { instance, tag, defaultType } = params;\n  const value = instance[tag];\n  if (value instanceof Array \u0026\u0026 value[0] instanceof ArrayBuffer) {\n    return URL.createObjectURL(new Blob([value[0]], { type: defaultType }));  // attacker MIME\n  }\n},\n```\n\n*DICOMweb InlineBinary:* `extensions/default/src/utils/getDirectURL.ts:40-44` →\n`platform/core/src/utils/b64toBlob.js:18`\n```js\nif (value.InlineBinary) {\n  const blob = utils.b64toBlob(value.InlineBinary, defaultType);   // -\u003e new Blob(..., { type: defaultType })\n  value.DirectRetrieveURL = URL.createObjectURL(blob);\n  return value.DirectRetrieveURL;\n}\n```\n\n*DICOMweb bulk data:* `extensions/default/src/utils/getDirectURL.ts:52-55`\n```js\nreturn value.retrieveBulkData(options).then(arr =\u003e {\n  value.DirectRetrieveURL = URL.createObjectURL(new Blob([arr], { type: defaultType }));\n  return value.DirectRetrieveURL;\n});\n```\n\n**Render** — `extensions/dicom-pdf/src/viewports/OHIFCornerstonePdfViewport.tsx:86-92`\n```tsx\n\u003cobject\n  data={url}                 {/* blob: URL whose stored MIME = attacker's MIMETypeOfEncapsulatedDocument */}\n  type=\"application/pdf\"     {/* only a hint; overridden by the blob's own Content-Type */}\n  className={style}\n\u003e\n```\n\n**Why it fires.** A `blob:` URL stores the MIME type passed at `new Blob(..., { type })`\nconstruction. When such a URL is navigated/embedded, the browser uses the blob's stored\nContent-Type to choose a handler; the `\u003cobject type=\"application/pdf\"\u003e` attribute is a\npre-load hint, not an override. A blob created with `type: 'text/html'` therefore renders as an\nHTML document, and because `blob:` URLs inherit the creating page's origin, any `\u003cscript\u003e` in it\nexecutes **in the OHIF origin** — with access to `localStorage`/`sessionStorage`, auth tokens,\nand same-origin requests to the PACS.\n\n### Impact\nUsers using the applications. If the application is behind authentication then session can be stolen. If on the same DNS name some other applications are hosted, they are also impacted.\n\n### Patches\n\nFixed in `@ohif/extension-dicom-pdf` `3.12.18`, `3.13.10` and `3.14.0-beta.36` (fix: https://github.com/OHIF/Viewers/pull/6228).\nIf you build OHIF from source, the fix first landed in tags `3.12.15`, `3.13.7` and `3.14.0-beta.19`.\nVersions `3.5` to `3.11` will not receive a fix. Upgrade to a patched `3.12`, `3.13` or `3.14` version.","status":"published","published":"2026-11-10T15:57:51Z","modified":"2026-11-10T16:15:05.409189579Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-10T16:33:19.672166Z"}]}}