JEDI-SEC | Security Research & Digital Defense

GHSA-xwgp-w3pj-q5h3: OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document

Written by

jedisec_u136k7

in

  • Severity: HIGH
  • CVE: CVE-2026-118670
  • Ecosystems: npm, npm, npm
  • Packages: @ohif/extension-dicom-pdf, @ohif/extension-dicom-pdf, @ohif/extension-dicom-pdf

### Summary
An XSS (Cross-Site Scripting) vulnerability occurs when an attacker is able to inject their own JavaScript code into a web page’s source, which is subsequently processed by the victim’s browser. A common cause of this vulnerability is the failure to validate user-supplied data before displaying it within the vulnerable application without proper filtering. To exploit the vulnerability, an attacker must input HTML code into a vulnerable parameter containing structures that trigger the execution of JavaScript. The DOM XSS variant occurs when user-supplied data is processed by a client-side script; if this data is not handled correctly by the script itself, it becomes possible to inject additional JavaScript commands.

**Attacker model:** Any actor who can get a DICOM object in front of a victim — email a `.dcm`
for local viewing, upload to a shared PACS, or operate/compromise a DICOMweb source.
**Preconditions:** Victim opens a study whose SOP Class is Encapsulated PDF
(`1.2.840.10008.5.1.4.1.1.104.1`) and OHIF’s `dicom-pdf` extension renders it (default in the
standard modes).

#### Taint path

**Source** — two attacker-controlled tags on the encapsulated-document instance:
– `MIMETypeOfEncapsulatedDocument` (0042,0012)
– `EncapsulatedDocument` (0042,0011) — the raw document bytes

`extensions/dicom-pdf/src/getSopClassHandlerModule.js:15,20` reads the MIME tag with no
validation and passes it as `defaultType`:

“`js
const { SeriesDescription = ‘PDF’, MIMETypeOfEnc…

Source: GitHub Security Advisories · 2026-11-10

More posts