CVE-2026-118670: DOM-Based Cross-Site Scripting in OHIF Viewers dicom-pdf Extension

Vulnerability ID: CVE-2026-118670
CVSS Score: 8.8
Published: 2026-11-10

CVE-2026-118670 (GHSA-xwgp-w3pj-q5h3) is a high-severity DOM-based Cross-Site Scripting (XSS) vulnerability in OHIF Viewers affecting the dicom-pdf extension module. When processing DICOM Encapsulated Document objects, the viewer extracts the untrusted MIMETypeOfEncapsulatedDocument attribute (tag 0042,0012) and uses it directly to instantiate an in-memory Blob. This Blob is then converted to a same-origin Object URL and embedded into the document via an HTML element. Because browsers prioritize the resource's underlying MIME type over the element's type attribute, an attacker who supplies a crafted DICOM file with a MIME type such as text/html can execute arbitrary JavaScript within the application's origin, compromising session tokens, local storage, and Patient Health Information (PHI).

TL;DR

OHIF Viewers trusts the attacker-controlled MIMETypeOfEncapsulatedDocument DICOM attribute when creating a same-origin Blob URL rendered inside an HTML tag. Supplying an HTML payload with a text/html MIME type results in same-origin JavaScript execution when a user views the study.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability Type: DOM-Based Cross-Site Scripting (CWE-79)
• Affected Component: @ohif/extension-dicom-pdf (DICOM Encapsulated Document Handler)
• Attack Vector: Network / Malicious DICOM Study (Tag 0042,0012)
• CVSS v3.1 Score: 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L)
• EPSS Score: 0.42% (36.69th Percentile)
• Impact: Same-origin JS execution, OIDC/OAuth token theft, PHI exposure
• CISA KEV Status: Not Listed
• Fixed Versions: 3.12.15, 3.13.7, 3.14.0-beta.19

Affected Systems

• OHIF Viewers (@ohif/viewer)
• OHIF DICOM PDF Extension (@ohif/extension-dicom-pdf)
• OHIF Core (@ohif/core)
• OHIF Viewers: >= 3.5.0-beta.0, < 3.12.15 (Fixed in: 3.12.15)
• OHIF Viewers: >= 3.13.0-beta.0, < 3.13.7 (Fixed in: 3.13.7)
• OHIF Viewers: >= 3.14.0-beta.0, < 3.14.0-beta.19 (Fixed in: 3.14.0-beta.19)

Code Analysis

Commit: ef0811c

Enforce MIME type allowlist, %PDF- magic byte signature check, and iframe sandboxing for encapsulated documents

Commit: db54670

Backport dicom-pdf MIME verification and sandboxing fix to v3.13.7 release branch

Commit: f0dba78

Backport dicom-pdf MIME verification and sandboxing fix to v3.12.15 release branch

Mitigation Strategies

• Upgrade OHIF Viewers and the @ohif/extension-dicom-pdf package to fixed versions (3.12.15, 3.13.7, or 3.14.0-beta.19).
• Enforce strict Content Security Policy (CSP) headers (specifically script-src 'self' to block inline scripts in blob: origins and connect-src to restrict unauthorized data exfiltration).
• Configure PACS and DICOMweb gateways (STOW-RS / C-STORE) to validate that Encapsulated PDF Storage instances (SOP Class 1.2.840.10008.5.1.4.1.1.104.1) declare a strict 'application/pdf' MIME type in tag (0042,0012) and start with the '%PDF-' file signature.

Remediation Steps:

1. Identify the deployed version of @ohif/viewer and @ohif/extension-dicom-pdf in your application's package.json or container image.
2. Update dependencies to >= 3.12.15 (for 3.12.x), >= 3.13.7 (for 3.13.x), or >= 3.14.0-beta.19 (for 3.14.x).
3. Rebuild and redeploy the OHIF static bundle to your web hosting infrastructure.
4. Verify that opening a test DICOM file with tag (0042,0012) set to 'text/html' renders inside a restricted element rather than an <object> element, and that a file claiming &#39;application/pdf&#39; without a &#39;%PDF-&#39; header triggers a signature mismatch error.</li> </ol> <h2> <a name="references" href="#references" class="anchor"> </a> References </h2>

   <ul>
   <li><a href="https://github.com/OHIF/Viewers/security/advisories/GHSA-xwgp-w3pj-q5h3"&gt;GitHub Security Advisory: GHSA-xwgp-w3pj-q5h3</a></li>
   <li><a href="https://github.com/OHIF/Viewers/pull/6228"&gt;OHIF Viewers Pull Request #6228</a></li>
   <li><a href="https://github.com/OHIF/Viewers/commit/ef0811c66cdb04ba07ffaba145cf66ce01486899"&gt;Fix Commit ef0811c66cdb04ba07ffaba145cf66ce01486899</a></li>
   <li><a href="https://github.com/OHIF/Viewers/commit/db546701bd5f2be9031c835f1de5c40aacd3dc62"&gt;Backport Commit db546701bd5f2be9031c835f1de5c40aacd3dc62 (v3.13.7)</a></li>
   <li><a href="https://github.com/OHIF/Viewers/commit/f0dba789a313f40fe7e8a8cbec322a8d8a491d76"&gt;Backport Commit f0dba789a313f40fe7e8a8cbec322a8d8a491d76 (v3.12.15)</a></li>
   <li><a href="https://github.com/OHIF/Viewers/releases/tag/v3.12.15"&gt;OHIF Viewers Release v3.12.15</a></li>
   <li><a href="https://github.com/OHIF/Viewers/releases/tag/v3.13.7"&gt;OHIF Viewers Release v3.13.7</a></li>
   <li><a href="https://github.com/OHIF/Viewers/releases/tag/v3.14.0-beta.19"&gt;OHIF Viewers Release v3.14.0-beta.19</a></li>
   <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-118670"&gt;NVD - CVE-2026-118670</a></li>
   <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-118670"&gt;CVE.org Record: CVE-2026-118670</a></li>
   <li><a href="https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118670.json"&gt;CVEListV5 JSON Record: CVE-2026-118670</a></li>
   </ul>

   <hr>

   <p><em><a href="https://cvereports.com/reports/CVE-2026-118670"&gt;Read the full report for CVE-2026-118670 on our website</a> for more details including interactive diagrams and full exploit analysis.</em></p>