{"metadata": {"vulnerability": "CVE-2026-91127", "count": 14, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-09-14T19:36:48.844Z", "date_only": false, "value": "2026-09-14T19:36:48.844Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-91127", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-18T17:18:40.370Z", "date_only": false, "value": "2026-09-18T17:18:40.370Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-91127", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-18T17:18:40.370Z", "date_only": false, "value": "2026-09-18T17:18:40.370Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-91127", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-18T17:19:42Z", "date_only": false, "value": "2026-09-18T17:19:42Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3753-M2X2-Q623", "record": "GHSA-3753-M2X2-Q623", "field": "published"}, {"timestamp": "2026-09-18T17:19:42Z", "date_only": false, "value": "2026-09-18T17:19:42Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3753-M2X2-Q623", "record": "GHSA-3753-M2X2-Q623", "field": "modified"}, {"timestamp": "2026-09-18T18:18:02.250Z", "date_only": false, "value": "2026-09-18T18:18:02.250", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-91127", "record": "FKIE_CVE-2026-91127", "field": "published"}, {"timestamp": "2026-09-19T07:32:11.908Z", "date_only": false, "value": "2026-09-19T07:32:11.908608Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/bf97988f1160e11a1fe815e1134e8b70", "record": "CVE-2026-91127", "field": "creation_timestamp", "uuid": "c596250d-7615-4834-bd64-ee77582596d7", "content": "# CVE-2026-91127: CVE-2026-91127: DOM Cross-Site Scripting via Unsafe Hyperlink Schemes in Flyfish File Viewer Legacy DOC Renderer\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-91127\n\n## Summary\nThis report details CVE-2026-91127 (GHSA-3753-m2x2-q623), a high-severity DOM Cross-Site Scripting (DOM XSS) vulnerability in the file-viewer workspace developed by flyfish-dev. The legacy Word document (.doc) parser fails to restrict hyperlink URI schemes when rendering extracted document targets into generated HTML. As a result, a remote attacker can construct a malicious legacy DOC file containing scripts inside hyperlink properties. When a user previews the file and clicks the hyperlink, arbitrary JavaScript executes in the context of the hosting origin, enabling session hijacking, credential theft, or unauthorized API interaction.\n\n## TL;DR\nThe legacy DOC file parser in Flyfish File Viewer fails to sanitize hyperlink schemes before injecting them into anchor tags. Under typical execution flows, an attacker can embed malicious javascript: or vbscript: URIs into document links, executing arbitrary script in the host application's origin upon user click. This high-severity flaw (CVSS 8.2) is remediated in package versions starting with @file-viewer/doc 2.3.1.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79, CWE-83\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.2 (High)\n- **EPSS Score**: N/A\n- **Impact**: DOM Cross-Site Scripting (DOM XSS)\n- **Exploit Status**: PoC (Proof-of-Concept)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- flyfish-dev file-viewer (workspace integration)\n- @file-viewer/doc\n- msdoc-viewer\n- @file-viewer/renderer-word\n- @file-viewer/preset-all\n- @file-viewer/preset-office\n- @file-viewer/vue3-full\n- @file-viewer/react-full\n- @file-viewer/web-full\n- **@file-viewer/doc**: < 2.3.1 (Fixed in: `2.3.1`)\n- **msdoc-viewer**: < 0.2.2 (Fixed in: `0.2.2`)\n- **@file-viewer/renderer-word**: < 2.3.2 (Fixed in: `2.3.2`)\n- **@file-viewer/preset-all**: < 2.3.4 (Fixed in: `2.3.4`)\n\n## Mitigation\n\n- Upgrade @file-viewer/doc to 2.3.1 or higher\n- Implement strict Content Security Policy (CSP) blocking inline execution\n- Restrict or disable preview options for legacy .doc formats, allowing download-only access.\n\n**Remediation Steps:**\n1. Identify all occurrences of flyfish-dev viewer packages in workspace dependencies.\n2. Run `pnpm add @file-viewer/vue3-full@2.3.4` or the corresponding package target.\n3. Validate dependencies lockfile to confirm no nested packages use vulnerable versions.\n4. Deploy strict CSP headers targeting host origins.\n\n## References\n\n- [NVD Detail page](https://nvd.nist.gov/vuln/detail/CVE-2026-91127)\n- [GitHub Security Advisory GHSA-3753-m2x2-q623](https://github.com/flyfish-dev/file-viewer/security/advisories/GHSA-3753-m2x2-q623)\n- [CVE.org Authoritative Record](https://www.cve.org/CVERecord?id=CVE-2026-91127)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-91127) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/bf97988f1160e11a1fe815e1134e8b70"}, {"timestamp": "2026-09-22T15:10:14.012Z", "date_only": false, "value": "2026-09-22T15:10:14.012431Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-91127", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-22T15:10:14.012Z", "date_only": false, "value": "2026-09-22T15:10:14.012431Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-91127", "record": "FKIE_CVE-2026-91127", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-22T15:10:24.440Z", "date_only": false, "value": "2026-09-22T15:10:24.440Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-91127", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-22T15:10:24.440Z", "date_only": false, "value": "2026-09-22T15:10:24.440Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-91127", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-24T21:25:27.050Z", "date_only": false, "value": "2026-09-24T21:25:27.050", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-91127", "record": "FKIE_CVE-2026-91127", "field": "lastModified"}, {"timestamp": "2026-09-26T03:30:21.111Z", "date_only": false, "value": "2026-09-26T03:30:21.111865Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mwfdtwwj6x2i", "record": "CVE-2026-91127", "field": "creation_timestamp", "uuid": "e4a74f1a-a719-47f7-b2a2-8565ab35bc8a", "content": "CVE-2026-91127: XSS in File Viewer legacy DOC renderer, CVSS 8.2, no patch yet. Malicious DOC injects javascript: links, executing script in your app. Update to @file-viewer/doc 2.3.1 immediately. https://www.valtersit.com/cve/CVE-2026-91127/ #CVE #infosec", "url": "https://bsky.app/profile/hugovalters.bsky.social/post/3mwfdtwwj6x2i"}, {"timestamp": "2026-09-26T03:30:44.923Z", "date_only": false, "value": "2026-09-26T03:30:44.923494Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/users/hugovalters/statuses/117335222384322190", "record": "CVE-2026-91127", "field": "creation_timestamp", "uuid": "f5121588-25f4-44bc-af48-b6f3a8041b91", "content": "CVE-2026-91127: XSS in File Viewer legacy DOC renderer, CVSS 8.2, no patch yet. Malicious DOC injects javascript: links, executing script in your app. Update to @file-viewer/doc 2.3.1 immediately. https://www.valtersit.com/cve/CVE-2026-91127/ #CVE #infosec", "url": "https://mastodon.social/users/hugovalters/statuses/117335222384322190"}]}