{"vulnerability": "ghsa-3753-m2x2-q623", "sightings": [{"uuid": "a1e64e82-d4f2-4a3d-93b6-3da21cd320bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-3753-m2x2-q623", "type": "seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mvsvj6zwrr2q", "content": "https://github.com/advisories/GHSA-3753-m2x2-q623\nmore like this: https://standup.thecompound.tech/sb/qc9739", "creation_timestamp": "2026-09-18T19:25:52.478035Z"}, {"uuid": "5cf65de3-7785-4e12-8fe0-3d14cc3653a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-3753-m2x2-q623", "type": "seen", "source": "https://gist.github.com/alon710/bf97988f1160e11a1fe815e1134e8b70", "content": "# CVE-2026-91127: CVE-2026-91127: DOM Cross-Site Scripting via Unsafe Hyperlink Schemes in Flyfish File Viewer Legacy DOC Renderer\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-91127\n\n## Summary\nThis report details CVE-2026-91127 (GHSA-3753-m2x2-q623), a high-severity DOM Cross-Site Scripting (DOM XSS) vulnerability in the file-viewer workspace developed by flyfish-dev. The legacy Word document (.doc) parser fails to restrict hyperlink URI schemes when rendering extracted document targets into generated HTML. As a result, a remote attacker can construct a malicious legacy DOC file containing scripts inside hyperlink properties. When a user previews the file and clicks the hyperlink, arbitrary JavaScript executes in the context of the hosting origin, enabling session hijacking, credential theft, or unauthorized API interaction.\n\n## TL;DR\nThe legacy DOC file parser in Flyfish File Viewer fails to sanitize hyperlink schemes before injecting them into anchor tags. Under typical execution flows, an attacker can embed malicious javascript: or vbscript: URIs into document links, executing arbitrary script in the host application's origin upon user click. This high-severity flaw (CVSS 8.2) is remediated in package versions starting with @file-viewer/doc 2.3.1.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79, CWE-83\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.2 (High)\n- **EPSS Score**: N/A\n- **Impact**: DOM Cross-Site Scripting (DOM XSS)\n- **Exploit Status**: PoC (Proof-of-Concept)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- flyfish-dev file-viewer (workspace integration)\n- @file-viewer/doc\n- msdoc-viewer\n- @file-viewer/renderer-word\n- @file-viewer/preset-all\n- @file-viewer/preset-office\n- @file-viewer/vue3-full\n- @file-viewer/react-full\n- @file-viewer/web-full\n- **@file-viewer/doc**: < 2.3.1 (Fixed in: `2.3.1`)\n- **msdoc-viewer**: < 0.2.2 (Fixed in: `0.2.2`)\n- **@file-viewer/renderer-word**: < 2.3.2 (Fixed in: `2.3.2`)\n- **@file-viewer/preset-all**: < 2.3.4 (Fixed in: `2.3.4`)\n\n## Mitigation\n\n- Upgrade @file-viewer/doc to 2.3.1 or higher\n- Implement strict Content Security Policy (CSP) blocking inline execution\n- Restrict or disable preview options for legacy .doc formats, allowing download-only access.\n\n**Remediation Steps:**\n1. Identify all occurrences of flyfish-dev viewer packages in workspace dependencies.\n2. Run `pnpm add @file-viewer/vue3-full@2.3.4` or the corresponding package target.\n3. Validate dependencies lockfile to confirm no nested packages use vulnerable versions.\n4. Deploy strict CSP headers targeting host origins.\n\n## References\n\n- [NVD Detail page](https://nvd.nist.gov/vuln/detail/CVE-2026-91127)\n- [GitHub Security Advisory GHSA-3753-m2x2-q623](https://github.com/flyfish-dev/file-viewer/security/advisories/GHSA-3753-m2x2-q623)\n- [CVE.org Authoritative Record](https://www.cve.org/CVERecord?id=CVE-2026-91127)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-91127) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-19T07:32:11.961070Z"}]}