@eigenpal/docx-editor-react: CSS injection and print-time XSS
A crafted Word document can alter the page when opened in docx-editor. Printing it can let the document run scripts inside the website showing it.
- Severity
- HighCVSS 8.1
- Fix
- Fixed in 1.8.3Fix recorded yesterday
- Affected versions
- 1.8.2 or older; 1.8.2 or older
- Affects
- @eigenpal/docx-editor-core+1 more
How it works
- The document supplies an embedded font name. docx-editor places that name into page styling without safely escaping it.
- A crafted name can alter the page immediately, then run scripts when someone prints the document.
What to do
Run npm ls --all @eigenpal/docx-editor-core @eigenpal/docx-editor-react and compare installed versions with the affected range. Versions 1.8.2 and older are affected; package presence alone does not prove exploitation.
Run this in the application environment you want to check:
npm ls --all @eigenpal/docx-editor-core @eigenpal/docx-editor-reactUpgrade both packages to version 1.8.3. That release escapes embedded font names and builds print pages without the unsafe document.write operation.
Technical details
Affected software: @eigenpal/docx-editor-core, @eigenpal/docx-editor-react
GHSA-x7m8-jrm8-hpvx affects both npm packages through unescaped font names from word/fontTable.xml. Version 1.8.3 escapes those names and changes the print flow to use DOM APIs.
References
- osv.dev · GHSA-X7M8-JRM8-HPVX vdb entry
- github.com · GHSA-x7m8-jrm8-hpvx vendor advisory