{"action":"Upgrade @eigenpal/docx-editor-react to 1.8.3 or later.","affected":[{"fixed":"1.8.3","introduced":"0"}],"component":"@eigenpal/docx-editor-react","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["1.8.3"],"ghsa_id":"GHSA-x7m8-jrm8-hpvx","id":"tcs_01M5KGHAEFF55ZP04DGM6WW2QC","modified_at":"2026-09-10T15:15:06.004637443Z","published_at":"2026-09-10T15:06:16Z","references":["https://osv.dev/vulnerability/GHSA-x7m8-jrm8-hpvx","https://github.com/eigenpal/docx-editor/security/advisories/GHSA-x7m8-jrm8-hpvx","https://github.com/eigenpal/docx-editor"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-x7m8-jrm8-hpvx#npm/@eigenpal/docx-editor-react","url":"https://osv.dev/vulnerability/GHSA-x7m8-jrm8-hpvx"}],"summary":"@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name"}