{"id":"CVE-2026-118670","published":"2026-11-06T18:17:57.340","lastModified":"2026-11-06T18:17:57.340","description":"OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it as the Blob media type for the attacker-controlled EncapsulatedDocument bytes. When a victim opens Encapsulated PDF SOP Class 1.2.840.10008.5.1.4.1.1.104.1, extensions/dicom-pdf/src/viewports/OHIFCornerstonePdfViewport.tsx embeds the Blob URL in an object element. A Blob labeled as HTML is handled as HTML despite the application/pdf object hint, and the Blob inherits the OHIF origin, allowing embedded script to access session storage, authentication tokens, and same-origin PACS requests. The malicious DICOM object may be opened locally, uploaded to a shared PACS, or supplied by a DICOMweb source. This issue is fixed in source versions 3.12.15, 3.13.7, and 3.14.0-beta.19.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/OHIF/Viewers/commit/db546701bd5f2be9031c835f1de5c40aacd3dc62","tags":[]},{"url":"https://github.com/OHIF/Viewers/commit/ef0811c66cdb04ba07ffaba145cf66ce01486899","tags":[]},{"url":"https://github.com/OHIF/Viewers/commit/f0dba789a313f40fe7e8a8cbec322a8d8a491d76","tags":[]},{"url":"https://github.com/OHIF/Viewers/pull/6228","tags":[]},{"url":"https://github.com/OHIF/Viewers/releases/tag/v3.12.15","tags":[]},{"url":"https://github.com/OHIF/Viewers/releases/tag/v3.13.7","tags":[]},{"url":"https://github.com/OHIF/Viewers/releases/tag/v3.14.0-beta.19","tags":[]},{"url":"https://github.com/OHIF/Viewers/security/advisories/GHSA-xwgp-w3pj-q5h3","tags":[]}],"exploitRefs":[{"url":"https://github.com/OHIF/Viewers/commit/db546701bd5f2be9031c835f1de5c40aacd3dc62","tags":[]},{"url":"https://github.com/OHIF/Viewers/commit/ef0811c66cdb04ba07ffaba145cf66ce01486899","tags":[]},{"url":"https://github.com/OHIF/Viewers/commit/f0dba789a313f40fe7e8a8cbec322a8d8a491d76","tags":[]},{"url":"https://github.com/OHIF/Viewers/pull/6228","tags":[]},{"url":"https://github.com/OHIF/Viewers/releases/tag/v3.12.15","tags":[]},{"url":"https://github.com/OHIF/Viewers/releases/tag/v3.13.7","tags":[]},{"url":"https://github.com/OHIF/Viewers/releases/tag/v3.14.0-beta.19","tags":[]},{"url":"https://github.com/OHIF/Viewers/security/advisories/GHSA-xwgp-w3pj-q5h3","tags":[]}],"hasPoc":true,"ai":{"summary":"The OHIF Viewer's dicom-pdf extension incorrectly uses attacker-controlled MIME type values to render encapsulated PDF documents as HTML blobs, enabling script execution in the OHIF origin. This allows theft of session tokens, storage data, and same-origin PACS requests via malicious DICOM files.","exploitability":"Exploitation requires a victim to open a specially crafted DICOM file containing a malicious EncapsulatedDocument with MIME type 'text/html' or similar HTML-capable type; user interaction is required (CVSS UI:R).","blast_radius":"Successful exploitation grants attackers full access to the victim's OHIF session, including authentication tokens and PACS data, potentially enabling lateral movement within the imaging infrastructure.","remediation":"Upgrade to OHIF Viewer versions 3.12.15, 3.13.7, or 3.14.0-beta.19 (or later) to patch the MIME type validation flaw in the dicom-pdf extension.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","web","pacs","session-hijack","malicious-dicom"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:51:18.013Z"}}