CVE-2026-91127: File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer

September 18, 2026

Before 2.3.1, the legacy .doc renderer emitted document hyperlink targets after HTML escaping but without a URL-scheme allowlist. A crafted .doc could therefore render a live javascript:, vbscript:, data:, or similarly unsafe link. Script could execute in the embedding origin if a viewer clicked it.

References

github.com/advisories/GHSA-3753-m2x2-q623
github.com/flyfish-dev/file-viewer/commit/ef045680f8d9830a3eee9612f7df46a734361b07
github.com/flyfish-dev/file-viewer/releases/tag/v2.3.1
github.com/flyfish-dev/file-viewer/security/advisories/GHSA-3753-m2x2-q623
nvd.nist.gov/vuln/detail/CVE-2026-91127

Code Behaviors & Features

Detect and mitigate CVE-2026-91127 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →