CVE-2026-30691: @cyntler/react-doc-viewer's TXTRenderer fails to sanitize file content and explicitly casts raw data as a ReactNode

May 20, 2026 (updated June 11, 2026)

Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt file. The TXTRenderer component fails to sanitize file content and explicitly casts raw data as a ReactNode.

References

github.com/advisories/GHSA-fvhg-p4hf-79x3
github.com/cyntler/react-doc-viewer/issues/317
github.com/walidriouah/CVE-2026-30691
nvd.nist.gov/vuln/detail/CVE-2026-30691

Code Behaviors & Features

Detect and mitigate CVE-2026-30691 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →