XSS in Ohif Viewers

CVE-2026-118670

OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it as the Blob media type for the attacker-controlled EncapsulatedDocument bytes. When a victim opens Encapsulated PDF SOP Class 1.2.840.10008.5.1.4.1.1.104.1, extensions/dicom-pdf/src/viewports/OHIFCornerstonePdfViewport.tsx embeds the Blob URL in an object element. A Blob labeled as HTML is handled as HTML despite the application/pdf object hint, and the Blob inherits the OHIF origin, allowing embedded script to access session storage, authentication tokens, and same-origin PACS requests. The malicious DICOM object may be opened locally, uploaded to a shared PACS, or supplied by a DICOMweb source. This issue is fixed in source versions 3.12.15, 3.13.7, and 3.14.0-beta.19.

Vulnerability class: XSS (Cross-Site Scripting)

Published .

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

  • Ohif Viewers — versions >= 3.13.0-beta.0, < 3.13.7, >= 3.14.0-beta.0, < 3.14.0-beta.19, >= 3.5.0-beta.0, < 3.12.15

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-118670?
CVE-2026-118670 is a high-severity vulnerability in Ohif Viewers, classified under Cross-site Scripting. CVSS score: 8.8/10. Published 2026-11-06.
How severe is CVE-2026-118670?
High severity. CVSS v3 base score is 8.8 out of 10.