{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/@ohif/extension-dicom-pdf-vulnerable--3.5.0-beta.0--3.12.18/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-118670"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@ohif/extension-dicom-pdf (vulnerable: \u003e= 3.5.0-beta.0, \u003c 3.12.18)","@ohif/extension-dicom-pdf (vulnerable: \u003e= 3.13.0-beta.0, \u003c 3.13.10)","@ohif/extension-dicom-pdf (vulnerable: \u003e= 3.14.0-beta.0, \u003c 3.14.0-beta.36)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe \u003ccode\u003edicom-pdf\u003c/code\u003e extension in OHIF Viewers improperly processes the \u003ccode\u003eMIMETypeOfEncapsulatedDocument\u003c/code\u003e (0042,0012) tag from DICOM objects. This value is used to set the \u003ccode\u003eBlob\u003c/code\u003e type when creating a retrieval URL for an encapsulated document. Because the MIME type is not validated, an attacker can specify \u003ccode\u003etext/html\u003c/code\u003e, causing the browser to render the document contents as an HTML page. Since \u003ccode\u003eblob:\u003c/code\u003e URLs inherit the origin of the creating page, any malicious scripts injected into the document bytes will execute with the application's permissions, including access to local storage and session information.\u003c/p\u003e\n","date_modified":"2026-11-11T11:52:24Z","date_published":"2026-11-11T11:52:24Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ohif-xss-ghsa-xwgp-w3pj-q5h3/","summary":"A DOM-based XSS vulnerability exists in the OHIF Viewers `dicom-pdf` extension, where unvalidated user-supplied MIME type data in DICOM objects can lead to arbitrary JavaScript execution within the application's origin.","title":"OHIF Viewers: DOM-Based Cross-Site Scripting via DICOM PDF handling (CVE-2026-118670)","url":"https://feed.craftedsignal.io/briefs/2026-11-ohif-xss-ghsa-xwgp-w3pj-q5h3/"}],"language":"en","title":"CraftedSignal Threat Feed - @Ohif/Extension-Dicom-Pdf (Vulnerable: \u003e= 3.5.0-Beta.0, \u003c 3.12.18)","version":"https://jsonfeed.org/version/1.1"}