CVE-2026-91127 in file-viewer
Summary
by MITRE • 09/18/2026
File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escaping but without restricting URL schemes. A crafted legacy DOC file could place javascript:, vbscript:, data:, or another unsafe scheme in a rendered link, and script could execute in the embedding application's origin when a user clicked the link. The fix blocks external document links by default, allows only HTTP(S), mail, telephone, safe relative URLs, and internal bookmarks when external links are explicitly enabled, and applies mount-boundary sanitization as defense in depth. This issue is fixed in @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified involves a critical flaw within the legacy document rendering engine of File Viewer, specifically affecting versions prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2. This component serves as a browser-native viewer designed for processing Office documents, PDFs, CAD files, archives, and other formats within private and internal web applications. The core issue stems from the handling of hyperlink targets embedded in legacy DOC files during their conversion to HTML. While the renderer correctly applied character escaping to prevent direct injection of script tags or malicious attributes into the DOM structure, it failed to enforce strict validation on the URL schemes associated with hyperlinks. This oversight allowed attackers to embed links utilizing dangerous protocols such as javascript:, vbscript:, and data: within the document content. When a user interacts with these crafted documents by clicking the embedded links, the browser interprets the unsafe scheme directives, leading to the execution of arbitrary scripts within the context of the embedding application's origin.
This technical flaw represents a classic case of insufficient input validation regarding URL schemes, which is formally categorized under CWE-79: Improper Neutralization of Input During Web Page Generation Cross-site Scripting and more specifically relates to CWE-829: Inclusion of Functionality from Untrusted Control Sources when considering the execution context. The vulnerability aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, as it enables an attacker to execute code via scripting engines available in modern web browsers. Because the script executes in the origin of the embedding application rather than a sandboxed or isolated environment, the impact is severe. An adversary can exploit this condition to perform cross-site scripting attacks that compromise session tokens, steal sensitive data stored in local storage or cookies, conduct phishing activities within the trusted interface, or pivot further into the internal network if the embedded application has access to other resources. The lack of scheme restriction means that even though the HTML structure is sanitized, the semantic meaning of a link can be weaponized to bypass traditional XSS filters that focus on tag injection rather than protocol manipulation.
The operational impact extends beyond simple script execution. In enterprise environments where File Viewer is integrated into internal portals or document management systems, this vulnerability undermines the trust boundary between user-uploaded content and application logic. Attackers could craft malicious DOC files distributed via email attachments or shared drives to target specific users within an organization. Successful exploitation allows for data exfiltration, credential harvesting, and potential lateral movement if combined with other vulnerabilities in the host environment. The risk is particularly acute because legacy DOC formats are still widely used in many industries, and users may not be aware that clicking a link inside a document triggers client-side code execution rather than navigating to an external website. This creates a deceptive attack vector where social engineering tactics can effectively bypass security awareness training focused on avoiding suspicious websites, as the malicious action occurs within what appears to be a trusted internal application interface.
To mitigate this vulnerability, organizations must immediately upgrade @file-viewer/doc to version 2.3.1 or later and msdoc-viewer to version 0.2.2 or higher. These updated versions implement a robust defense-in-depth strategy by blocking external document links by default. The fix restricts allowed URL schemes to only safe protocols such as HTTP, HTTPS, mailto, tel, and safe relative URLs when external linking is explicitly enabled through configuration settings. Additionally, the patch introduces mount-boundary sanitization to further isolate potential attack surfaces from the broader application context. Administrators should review their deployment configurations to ensure that any optional features allowing external links are disabled unless strictly necessary for business operations. If such functionality must be retained, it should be accompanied by additional content security policy headers and rigorous input validation on the server side before documents are processed. Regular vulnerability scanning of third-party dependencies is also recommended to maintain a secure posture against similar issues in other components that handle user-supplied data rendering.