https://feed.craftedsignal.io/products/@ohif/extension-dicom-pdf-vulnerable--3.14.0-beta.0--3.14.0-beta.36/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 11:52:24 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-ohif-xss-ghsa-xwgp-w3pj-q5h3/Wed, 11 Nov 2026 11:52:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-ohif-xss-ghsa-xwgp-w3pj-q5h3/A DOM-based XSS vulnerability exists in the OHIF Viewers `dicom-pdf` extension, where unvalidated user-supplied MIME type data in DICOM objects can lead to arbitrary JavaScript execution within the application's origin.The dicom-pdf extension in OHIF Viewers improperly processes the MIMETypeOfEncapsulatedDocument (0042,0012) tag from DICOM objects. This value is used to set the Blob type when creating a retrieval URL for an encapsulated document. Because the MIME type is not validated, an attacker can specify text/html, causing the browser to render the document contents as an HTML page. Since blob: URLs inherit the origin of the creating page, any malicious scripts injected into the document bytes will execute with the application's permissions, including access to local storage and session information.

]]>highadvisory