CVE-2026-118670 · Package
NO FIX YET · SEE WHAT TO DO
OHIF Viewers, a web viewer for medical imaging files, renders an embedded PDF inside a DICOM file using a MIME type taken from the file itself. A crafted DICOM object can make the browser treat the embedded document as HTML, so its script runs with the viewer's origin and can reach session storage, auth tokens and same-origin PACS requests.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run OHIF Viewers from 3.5.0-beta.0 up to the fixed versions, especially where users open DICOM files from shared PACS, DICOMweb sources or local files. Deployments that do not load the dicom-pdf extension or that run on a version outside the affected range are not exposed. unknown whether the sources name a default configuration that disables the extension.
Not affected if dicom-pdf-extension-not-loaded, version-outside-affected-range
Who cares dicom, healthcare, ohif-viewers, pacs, self-hosted
@ohif/viewer or OHIF app version and compare it with the fixed versions.dicom-pdf extension in the deployed build and confirm its version.3.12.15, 3.13.7 or 3.14.0-beta.19 (the fixed source versions in the 3.12, 3.13 and 3.14 lines).OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it as the Blob media type for the attacker-controlled EncapsulatedDocument bytes. When a victim opens Encapsulated PDF SOP Class 1.2.840.10008.5.1.4.1.1.104.1, extensions/dicom-pdf/src/viewports/OHIFCornerstonePdfViewport.tsx embeds the Blob URL in an object element. A Blob labeled as HTML is handled as HTML despite the application/pdf object hint, and the Blob inherits the OHIF origin, allowing embedded script to access session storage, authentication tokens, and same-origin PACS requests. The malicious DICOM object may be opened locally, uploaded to a shared PACS, or supplied by a DICOMweb source. This issue is fixed in source versions 3.12.15, 3.13.7, and 3.14.0-beta.19.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.