{"action":"Upgrade msdoc-viewer to 0.2.2 or later.","affected":[{"fixed":"0.2.2","introduced":"0"}],"component":"msdoc-viewer","cve_ids":["CVE-2026-91127"],"ecosystem":"npm","epss":0.00397,"exploited":false,"fixed_versions":["0.2.2"],"ghsa_id":"GHSA-3753-m2x2-q623","id":"tcs_01M5KEWBPS3H81MEVDA5NKBABQ","modified_at":"2026-09-18T17:30:10.133360774Z","published_at":"2026-09-18T17:19:42Z","references":["https://osv.dev/vulnerability/GHSA-3753-m2x2-q623","https://github.com/flyfish-dev/file-viewer/security/advisories/GHSA-3753-m2x2-q623","https://github.com/flyfish-dev/file-viewer/commit/ef045680f8d9830a3eee9612f7df46a734361b07","https://github.com/flyfish-dev/file-viewer","https://github.com/flyfish-dev/file-viewer/releases/tag/v2.3.1"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-3753-m2x2-q623#npm/msdoc-viewer","url":"https://osv.dev/vulnerability/GHSA-3753-m2x2-q623"}],"summary":"File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer"}