OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document
OHIF Viewers builds from 3.5.0-beta.0 onward that render Encapsulated PDF studies through the dicom-pdf extension, which is on by default in standard modes. Fixed in @ohif/extension-dicom-pdf 3.12.18, 3.13.10 and 3.14.0-beta.36.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 3.12.15, 3.13.7, 3.14.0-beta.19
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Victim opens a study whose SOP Class is Encapsulated PDF (1.2.840.10008.5.1.4.1.1.104.1) OHIF's dicom-pdf extension renders the encapsulated PDF object (default in the standard modes)
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 21/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
OHIF Viewers, a zero-footprint DICOM viewer, is affected by a cross-site scripting flaw in its dicom-pdf extension, which mishandles the MIME type of embedded encapsulated documents. An attacker can deliver a malicious DICOM object that, once a victim opens it (locally, via a shared PACS, or from a DICOMweb source), runs script in the viewer's origin and can reach session storage, authentication tokens, and same-origin PACS requests.
Read the original description
OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it as the Blob media type for the attacker-controlled EncapsulatedDocument bytes. When a victim opens Encapsulated PDF SOP Class 1.2.840.10008.5.1.4.1.1.104.1, extensions/dicom-pdf/src/viewports/OHIFCornerstonePdfViewport.tsx embeds the Blob URL in an object element. A Blob labeled as HTML is handled as HTML despite the application/pdf object hint, and the Blob inherits the OHIF origin, allowing embedded script to access session storage, authentication tokens, and same-origin PACS requests. The malicious DICOM object may be opened locally, uploaded to a shared PACS, or supplied by a DICOMweb source. This issue is fixed in source versions 3.12.15, 3.13.7, and 3.14.0-beta.19.
cve.now Index
- Exploitation0/40No signal
- Exposure12/25Specific setups only, reachable over the network without a login
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.8/10CVSS 8.8
- No patch0/5No signal
What would change the score
- Would score about 71 if added to CISA KEV
- Would score about 66 if CISA's SSVC rates exploitation active
What to do
Check whether your setup matches what the bug needs.
Victim opens a study whose SOP Class is Encapsulated PDF (1.2.840.10008.5.1.4.1.1.104.1) OHIF's dicom-pdf extension renders the encapsulated PDF object (default in the standard modes)Upgrade to a fixed version: 3.12.15, 3.13.7, 3.14.0-beta.19.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- OHIF Viewers
From 3.5.0-beta.0 · fixed in 3.12.15; From 3.13.0-beta.0 · fixed in 3.13.7; From 3.14.0-beta.0 · fixed in 3.14.0-beta.19
Evidence 8
- Advisory
- Repository
- Repository
- Repository
- Repository
Show all 8 sourcesShow fewer sources
- Repository
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-118670
Is CVE-2026-118670 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
An attacker can supply HTML inside an encapsulated PDF document, and the viewer runs its script in the OHIF origin. Where the app sits behind authentication, that script can steal the session, and it can also make same-origin requests to the PACS.Source: github.com
Which versions are affected by CVE-2026-118670?
Viewers: from 3.5.0-beta.0 before 3.12.15; from 3.13.0-beta.0 before 3.13.7; from 3.14.0-beta.0 before 3.14.0-beta.19.Source: cve.now feed data
Am I affected, and how do I check?
The affected range starts at 3.5.0-beta.0 and runs up to the fixed versions for each branch: below 3.12.18 (or 3.12.15 per the range data), below 3.13.10 (or 3.13.7), and below 3.14.0-beta.36 (or 3.14.0-beta.19). The bug needs a study whose SOP Class is Encapsulated PDF (1.2.840.10008.5.1.4.1.1.104.1) and the dicom-pdf extension rendering it, which is the default in standard modes. To check, look at the installed OHIF Viewers version and whether the dicom-pdf extension is active in the mode configuration.Source: github.com
How do I fix CVE-2026-118670?
Upgrade the @ohif/extension-dicom-pdf package to 3.12.18, 3.13.10 or 3.14.0-beta.36 on the matching branch, as the fix note lists. The affected-range data gives earlier fixed versions (3.12.15, 3.13.7, 3.14.0-beta.19), so choosing the later listed versions covers both.Source: github.com