Skip to content
Threat Feed
Subscribe

Product

@Ohif/Extension-Dicom-Pdf (Vulnerable: >= 3.14.0-Beta.0, < 3.14.0-Beta.36)

1 brief RSS
high advisory

OHIF Viewers: DOM-Based Cross-Site Scripting via DICOM PDF handling (CVE-2026-118670)

A DOM-based XSS vulnerability exists in the OHIF Viewers `dicom-pdf` extension, where unvalidated user-supplied MIME type data in DICOM objects can lead to arbitrary JavaScript execution within the application's origin.

@ohif/extension-dicom-pdf +2
1c