DOM XSS in File Viewer's Legacy DOC Renderer via Unsafe Hyperlink Schemes (CVE-2026-91127)

What happened

File Viewer's legacy DOC renderer takes hyperlink targets embedded in a DOC document and writes them into the HTML it generates for display. Prior to the fix, the renderer applied character escaping to these document-controlled hyperlink targets but did not restrict which URL schemes were allowed. As a result, a specially crafted legacy DOC file could place a scheme such as javascript:, vbscript:, data:, or another unsafe scheme into a rendered link. If a user then clicked that link, script could execute within the origin of the application embedding File Viewer.

Technical cause

The root cause is improper neutralization of input during web page generation, classified as CWE-79 (Cross-site Scripting). Escaping characters in the hyperlink text does not prevent execution if the underlying URL scheme itself is left unrestricted, since schemes like javascript: or vbscript: trigger code execution independent of character escaping in the visible link text.

Why it matters

Because File Viewer is embedded in private and internal web applications to render untrusted or semi-trusted files, a malicious DOC file delivered through normal workflows (e.g., document upload or sharing) could lead to script execution in the context of the hosting application once a user clicks a rendered link. The CVSS vector indicates the attack is network-based, requires low attack complexity, needs no privileges, but does require user interaction (clicking the link), and impacts confidentiality (high) and integrity (low) within a changed scope.

Who is affected

Applications that embed the @file-viewer/doc package at version 2.3.0 or earlier, or the msdoc-viewer package at version 0.2.1 or earlier, to render legacy DOC files are affected.

Affected versions

@file-viewer/doc: versions up to and including 2.3.0 are affected; fixed in 2.3.1. msdoc-viewer: versions up to and including 0.2.1 are affected; fixed in 0.2.2.

Fixes and mitigation

The fix blocks external document-controlled links by default. When external links are explicitly enabled by the embedding application, only HTTP(S), mail, telephone, safe relative URLs, and internal bookmarks are permitted. Mount-boundary sanitization is also applied as an additional defense-in-depth measure. These changes are included in @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2.

Recommended action

Update @file-viewer/doc to version 2.3.1 or later, and msdoc-viewer to version 0.2.2 or later. Review any application configuration that explicitly enables external links in rendered documents to confirm it relies on the updated scheme restrictions rather than custom handling.