{"id":"CVE-2026-118670","aliases":["GHSA-xwgp-w3pj-q5h3"],"url":"https://o3.security/vulnerability/CVE-2026-118670","summary":"OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document","details":"### Summary\nAn XSS (Cross-Site Scripting) vulnerability occurs when an attacker is able to inject their own JavaScript code into a web page's source, which is subsequently processed by the victim's browser. A common cause of this vulnerability is the failure to validate user-supplied data before displaying it within the vulnerable application without proper filtering. To exploit the vulnerability, an attacker must input HTML code into a vulnerable parameter containing structures that trigger the execution of JavaScript. The DOM XSS variant occurs when user-supplied data is processed by a client-side script; if this data is not handled correctly by the script itself, it becomes possible to inject additional JavaScript commands.\n\n**Attacker model:** Any actor who can get a DICOM object in front of a victim — email a `.dcm`\nfor local viewing, upload to a shared PACS, or operate/compromise a DICOMweb source.\n**Preconditions:** Victim opens a study whose SOP Class is Encapsulated PDF\n(`1.2.840.10008.5.1.4.1.1.104.1`) and OHIF's `dicom-pdf` extension renders it (default in the\nstandard modes).\n\n#### Taint path\n\n**Source** — two attacker-controlled tags on the encapsulated-document instance:\n- `MIMETypeOfEncapsulatedDocument` (0042,0012)\n- `EncapsulatedDocument` (0042,0011) — the raw document bytes\n\n`extensions/dicom-pdf/src/getSopClassHandlerModule.js:15,20` reads the MIME tag with no\nvalidation and passes it as `defaultType`:\n\n```js\nconst { SeriesDescription = 'PDF', MIMETypeOfEncapsulatedDocument } = instance;\n...\nconst renderedUrlParams = {\n instance,\n tag: 'EncapsulatedDocument',\n defaultType: MIMETypeOfEncapsulatedDocument || 'application/pdf', // attacker-controlled\n singlepart: 'pdf',\n};\nconst renderedUrl = dataSource.retrieve.directURL(renderedUrlParams);\n```\n\n**Sink** — `defaultType` becomes the `Blob` type in all three retrieval paths:\n\n*Local file (no server required):* `extensions/default/src/DicomLocalDataSource/index.js:120-131`\n```js\ndirectURL: params => {\n const { instance, tag, defaultType } = params;\n const value = instance[tag];\n if (value instanceof Array && value[0] instanceof ArrayBuffer) {\n return URL.createObjectURL(new Blob([value[0]], { type: defaultType })); // attacker MIME\n }\n},\n```\n\n*DICOMweb InlineBinary:* `extensions/default/src/utils/getDirectURL.ts:40-44` →\n`platform/core/src/utils/b64toBlob.js:18`\n```js\nif (value.InlineBinary) {\n const blob = utils.b64toBlob(value.InlineBinary, defaultType); // -> new Blob(..., { type: defaultType })\n value.DirectRetrieveURL = URL.createObjectURL(blob);\n return value.DirectRetrieveURL;\n}\n```\n\n*DICOMweb bulk data:* `extensions/default/src/utils/getDirectURL.ts:52-55`\n```js\nreturn value.retrieveBulkData(options).then(arr => {\n value.DirectRetrieveURL = URL.createObjectURL(new Blob([arr], { type: defaultType }));\n return value.DirectRetrieveURL;\n});\n```\n\n**Render** — `extensions/dicom-pdf/src/viewports/OHIFCornerstonePdfViewport.tsx:86-92`\n```tsx\n\n```\n\n**Why it fires.** A `blob:` URL stores the MIME type passed at `new Blob(..., { type })`\nconstruction. When such a URL is navigated/embedded, the browser uses the blob's stored\nContent-Type to choose a handler; the `` attribute is a\npre-load hint, not an override. A blob created with `type: 'text/html'` therefore renders as an\nHTML document, and because `blob:` URLs inherit the creating page's origin, any `