CVE-2026-91127: 
JavaScript 脆弱性の分析と軽減

CVE-2026-91127 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the legacy DOC renderer of the File Viewer library (@file-viewer/doc and msdoc-viewer), a browser-native viewer for Office, PDF, CAD, and other file formats used in private and internal web applications. The vulnerability affects @file-viewer/doc versions ≤ 2.3.0 and msdoc-viewer versions ≤ 0.2.1. It was responsibly reported by researcher @shashank420, published on August 24, 2026, and added to the GitHub Advisory Database on September 18, 2026. It carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, Security Advisory).

The root cause is improper neutralization of script in URL attributes (CWE-79, CWE-83): the legacy .doc renderer performed HTML character escaping on hyperlink targets extracted from document content but applied no URL-scheme allowlist. As a result, a crafted .doc file could embed javascript:, vbscript:, data:, or other unsafe URI schemes directly into rendered anchor href attributes in the generated HTML. When a user clicks such a link within the viewer, the browser evaluates the injected scheme in the embedding application's origin, achieving script execution. The attack requires no privileges and no special server-side conditions — only that the application renders an attacker-supplied .doc file and a user clicks the malicious link (GitHub Advisory, Security Advisory).

Successful exploitation allows attacker-controlled JavaScript to execute in the security origin of the embedding web application, enabling session token theft, credential harvesting, unauthorized API calls on behalf of the victim, and potential lateral movement within the application's trust boundary. The CVSS scope is marked as Changed, reflecting that the vulnerability in the renderer component can impact the broader embedding application's origin. Confidentiality impact is rated High (sensitive data accessible to the origin can be exfiltrated), integrity impact is Low, and there is no direct availability impact (GitHub Advisory, Security Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the advisory date. The EPSS score is 0.0, indicating a currently low probability of active exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (clicking a malicious link rendered from a crafted .doc file), but no attacker privileges or authentication are needed, making the attack surface relatively accessible in applications that accept user-uploaded documents (GitHub Advisory).

1. Craft a malicious .doc file: Create a legacy binary .doc file containing a hyperlink whose target URL uses an unsafe scheme, such as javascript:alert(document.cookie), vbscript:msgbox(1), or a data:text/html,... payload. Standard Office document editors or hex editors can be used to embed such hyperlinks in the document's link table.
2. Deliver the file to the target application: Upload or share the crafted .doc file through any channel the vulnerable application accepts — file upload forms, email attachments, shared storage, etc. — targeting an application that uses @file-viewer/doc ≤ 2.3.0 or msdoc-viewer ≤ 0.2.1 to render documents.
3. Induce the victim to open the file in the viewer: The attacker tricks a user (e.g., via phishing or social engineering) into opening the malicious .doc file within the vulnerable File Viewer instance embedded in the web application.
4. Trigger script execution via link click: The renderer emits the unsafe hyperlink into the DOM without scheme validation. When the victim clicks the rendered link, the browser evaluates the javascript: (or equivalent) URI in the embedding application's origin, executing the attacker's payload.
5. Achieve objective: The executed script can steal session cookies, exfiltrate sensitive data visible to the origin, perform actions on behalf of the user, or redirect the victim to an attacker-controlled site (GitHub Advisory, Security Advisory).

• Network: Unexpected outbound requests from the browser to attacker-controlled domains immediately following a user opening a .doc file in the viewer; unusual POST requests carrying session tokens or cookies to external endpoints.
• Logs: Application-level logs showing .doc file renders followed by navigation events or fetch requests to anomalous URLs; browser console errors referencing blocked javascript: or data: URIs (if CSP is in place).
• File System: Presence of .doc files with embedded hyperlinks using javascript:, vbscript:, or data: URI schemes in upload directories or document stores.
• Process/Browser Behavior: Unexpected script execution dialogs, redirects, or DOM mutations occurring immediately after a user clicks a link within a rendered legacy .doc document in the viewer.

Upgrade to the patched versions immediately: @file-viewer/doc@2.3.1 and msdoc-viewer@0.2.2 (also included in @file-viewer/renderer-word@2.3.2 and the 2.3.4 Office/Full/copy-assets patch line). The fix centralizes link handling, removes control-character and scheme confusion, blocks all external document links by default, and in explicit allow mode restricts links to HTTP(S), mailto, telephone, safe relative URLs, and internal bookmarks. Defense-in-depth sanitization using DOMPurify 3.4.13 is applied at the viewer mount boundary. As a workaround prior to patching, avoid rendering untrusted .doc files with the affected packages, or enforce a strict Content Security Policy (CSP) that blocks javascript: and data: URI execution (GitHub Release, GitHub Advisory).

The vulnerability was responsibly disclosed by researcher @shashank420 and acknowledged by the maintainer (wybaby168) in the official security advisory. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified at this time (Security Advisory).