{"metadata": {"vulnerability": "CVE-2026-46350", "count": 16, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 7}, "linked_omitted": 0}, "data": [{"timestamp": "2026-05-13T18:37:30.991Z", "date_only": false, "value": "2026-05-13T18:37:30.991Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-46350", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-27T13:29:57Z", "date_only": false, "value": "2026-10-27T13:29:57Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-PX68-XX5G-48Q5", "record": "GHSA-PX68-XX5G-48Q5", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-27T13:29:57Z", "date_only": false, "value": "2026-10-27T13:29:57Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-PX68-XX5G-48Q5", "record": "GHSA-PX68-XX5G-48Q5", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T20:18:20.099Z", "date_only": false, "value": "2026-11-05T20:18:20.099Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-46350", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-05T20:18:20.099Z", "date_only": false, "value": "2026-11-05T20:18:20.099Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-46350", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-05T20:21:55.226Z", "date_only": false, "value": "2026-11-05T20:21:55.226824Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117565693277675223", "record": "CVE-2026-46350", "field": "creation_timestamp", "uuid": "e8d248d7-bac6-4b22-9ba9-958835aeacba", "content": "CVE-2026-46350 dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS dcmjs is a JavaScript implementation of DICOM manipulation. Prior to 0.52.0, the DecimalString and IntegerString implementations in src/ValueRepresentation.js sanitize text with a permissive regular expression and pass the result to JavaScript's Number constructor without validating finiteness or the DICOM value-representation rules. Scientific notation overflow in a DS or IS field can produce positive or negative Infinity, while stripping alphabetic characters from signed infinity text can leave a sign-only string that converts to NaN. IntegerString also accepts exponent notation and values outside the DICOM signed 32-bit IS range. Applications that trust these parsed values can propagate invalid numbers into spatial geometry, display windowing, dose scaling, frame counts, rescaling, or volume reconstruction, causing incorrect calculations or disrupted processing. This issue is fixed in version 0.52.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-46350https://github.com/dcmjs-org/dcmjs/security/advisories/GHSA-px68-xx5g-48q5https://github.com/dcmjs-org/dcmjs/pull/497https://github.com/dcmjs-org/dcmjs/commit/81e7e11cdefb56aa1a65bfe259648b865583ff88https://github.com/dcmjs-org/dcmjs/releases/tag/v0.52.0#dcmjs-org #dcmjs#CVE_2026_46350#bot", "url": "https://infosec.exchange/users/cve/statuses/117565693277675223"}, {"timestamp": "2026-11-05T20:38:51.660Z", "date_only": false, "value": "2026-11-05T20:38:51.660747Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/patchthecve.bsky.social/post/3mzlpxvjpae2w", "record": "CVE-2026-46350", "field": "creation_timestamp", "uuid": "31626b4e-8321-424c-bfc4-ad6905fb9a10", "content": "CVE-2026-46350 CRITICAL (CVSS 9.1)\ndcmjs is a JavaScript implementation of DICOM manipulation\nFix: https://patchthecve.com/cve/CVE-2026-46350.html", "url": "https://bsky.app/profile/patchthecve.bsky.social/post/3mzlpxvjpae2w"}, {"timestamp": "2026-11-05T20:50:03.524Z", "date_only": false, "value": "2026-11-05T20:50:03.524957Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzlqlvw5uk2p", "record": "CVE-2026-46350", "field": "creation_timestamp", "uuid": "e548e442-8b58-4e69-adad-d79d4b9a430e", "content": "CVE-2026-46350 - dcmjs\nVersions of the dcmjs JavaScript library before 0.52.0 do not properly check certain numeric inputs, allowing specially formatted numbers to be interpreted as infinite or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#dcmjs #dcmjsorg #npm #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzlqlvw5uk2p"}, {"timestamp": "2026-11-05T21:18:50.110Z", "date_only": false, "value": "2026-11-05T21:18:50.110", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-46350", "record": "FKIE_CVE-2026-46350", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T22:08:09.003Z", "date_only": false, "value": "2026-11-05T22:08:09.003303Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzluxkpxqv2b", "record": "CVE-2026-46350", "field": "creation_timestamp", "uuid": "67d03636-b9f3-4e6d-8a44-143455b67df1", "content": "\ud83d\udea8 CVE-2026-46350 \u2014 CVSS 9.1 CRITICAL\n\ndcmjs is a JavaScript implementation of DICOM manipulation. Prior to 0.52.0, the DecimalString and IntegerS...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-46350\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzluxkpxqv2b"}, {"timestamp": "2026-11-09T17:38:46.808Z", "date_only": false, "value": "2026-11-09T17:38:46.808863Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-46350", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-09T17:38:46.808Z", "date_only": false, "value": "2026-11-09T17:38:46.808863Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-46350", "record": "FKIE_CVE-2026-46350", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-09T17:42:40.708Z", "date_only": false, "value": "2026-11-09T17:42:40.708Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-46350", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-09T17:42:40.708Z", "date_only": false, "value": "2026-11-09T17:42:40.708Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-46350", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-12T14:51:57.678Z", "date_only": false, "value": "2026-11-12T14:51:57.678395Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/5sq4l5s3ktp5v", "record": "CVE-2026-46350", "field": "creation_timestamp", "uuid": "0766e0c5-590c-4721-80fa-e5d97a42feac", "content": "\ud83d\udea8 CVE-2026-46350\nCVSS 9.1 / EPSS 0.6% / KEV: No\nTL;DR: dcmjs is a JavaScript implementation of DICOM manipulation. Prior to 0.52.0, the DecimalString and IntegerString implementations in src/ValueRepresentation.js sanitize\u2026\nhttps://cvesentinel.com/report/CVE-2026-46350\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/5sq4l5s3ktp5v"}, {"timestamp": "2026-11-12T22:18:51.470Z", "date_only": false, "value": "2026-11-12T22:18:51.470", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-46350", "record": "FKIE_CVE-2026-46350", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-13T10:21:19.423Z", "anchors": {"origin": {"timestamp": "2026-10-27T13:29:57Z", "date_only": false, "value": "2026-10-27T13:29:57Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-PX68-XX5G-48Q5", "record": "GHSA-PX68-XX5G-48Q5", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-27T13:29:57Z", "date_only": false, "value": "2026-10-27T13:29:57Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-PX68-XX5G-48Q5", "record": "GHSA-PX68-XX5G-48Q5", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1457482.42391, "hours": 404.8562288638889, "days": 16.86900953599537, "min_seconds": 1457482.42391, "max_seconds": 1457482.42391, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-27T13:29:57Z", "date_only": false, "value": "2026-10-27T13:29:57Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-PX68-XX5G-48Q5", "record": "GHSA-PX68-XX5G-48Q5", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-13T10:21:19.423Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}