OHIF Viewers: DOM-Based Cross-Site Scripting via DICOM PDF handling (CVE-2026-118670)
A DOM-based XSS vulnerability exists in the OHIF Viewers `dicom-pdf` extension, where unvalidated user-supplied MIME type data in DICOM objects can lead to arbitrary JavaScript execution within the application's origin.
CVE search metadata
CVE search record: CVE-2026-118670. Severity: high. CVSS: 8.8. EPSS: 0.42%. KEV: no. Product: @ohif/extension-dicom-pdf (vulnerable: >= 3.5.0-beta.0, < 3.12.18), @ohif/extension-dicom-pdf (vulnerable: >= 3.13.0-beta.0, < 3.13.10), @ohif/extension-dicom-pdf (vulnerable: >= 3.14.0-beta.0, < 3.14.0-beta.36). Brief: OHIF Viewers: DOM-Based Cross-Site Scripting via DICOM PDF handling (CVE-2026-118670). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ohif-xss-ghsa-xwgp-w3pj-q5h3/
Triage facts
Revision 1- Applicability
- @ohif/extension-dicom-pdf (vulnerable: >= 3.5.0-beta.0, < 3.12.18), @ohif/extension-dicom-pdf (vulnerable: >= 3.13.0-beta.0, < 3.13.10) +1
- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 11, 11:52 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Roughly even chance
The dicom-pdf extension in OHIF Viewers improperly processes the MIMETypeOfEncapsulatedDocument (0042,0012) tag from DICOM objects. This value is used to set the Blob type when creating a retrieval URL for an encapsulated document. Because the MIME type is not validated, an attacker can specify text/html, causing the browser to render the document contents as an HTML page. Since blob: URLs inherit the origin of the creating page, any malicious scripts injected into the document bytes will execute with the application's permissions, including access to local storage and session information.