{"id":"CVE-2026-118670","kind":"vulnerability","aliases":["CVE-2026-118670"],"related":[],"title":"OHIF Viewers: crafted DICOM PDF runs script in the viewer's origin","description":"OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it as the Blob media type for the attacker-controlled EncapsulatedDocument bytes. When a victim opens Encapsulated PDF SOP Class 1.2.840.10008.5.1.4.1.1.104.1, extensions/dicom-pdf/src/viewports/OHIFCornerstonePdfViewport.tsx embeds the Blob URL in an object element. A Blob labeled as HTML is handled as HTML despite the application/pdf object hint, and the Blob inherits the OHIF origin, allowing embedded script to access session storage, authentication tokens, and same-origin PACS requests. The malicious DICOM object may be opened locally, uploaded to a shared PACS, or supplied by a DICOMweb source. This issue is fixed in source versions 3.12.15, 3.13.7, and 3.14.0-beta.19.","summary":"OHIF Viewers, a web viewer for medical imaging files, renders an embedded PDF inside a DICOM file using a MIME type taken from the file itself. A crafted DICOM object can make the browser treat the embedded document as HTML, so its script runs with the viewer's origin and can reach session storage, auth tokens and same-origin PACS requests.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dicom","healthcare","ohif-viewers","package","pacs","self-hosted"],"not_affected_if":["dicom-pdf-extension-not-loaded","version-outside-affected-range"],"how_to_check":"- Check the installed `@ohif/viewer` or OHIF app version and compare it with the fixed versions.\n- Look for the `dicom-pdf` extension in the deployed build and confirm its version.","fix":"- Move to `3.12.15`, `3.13.7` or `3.14.0-beta.19` (the fixed source versions in the 3.12, 3.13 and 3.14 lines).","status":"open","published_at":"2026-11-06T18:17:57+00:00","first_seen_at":"2026-11-06T18:44:08+00:00","triaged_at":"2026-11-06T18:45:14+00:00","updated_at":"2026-11-06T18:45:14+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-06T18:45:14Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `3.12.15`, `3.13.7` or `3.14.0-beta.19` (the fixed source versions in the 3.12, 3.13 and 3.14 lines).","reach":"internet","title":"OHIF Viewers: crafted DICOM PDF runs script in the viewer's origin","impact":"high","summary":"OHIF Viewers, a web viewer for medical imaging files, renders an embedded PDF inside a DICOM file using a MIME type taken from the file itself. A crafted DICOM object can make the browser treat the embedded document as HTML, so its script runs with the viewer's origin and can reach session storage, auth tokens and same-origin PACS requests.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ohif-viewers","dicom","pacs","healthcare","self-hosted"],"confidence":0.75,"fix_status":"available","needs_auth":"no","worst_case":"Embedded script runs in the viewer origin, reading session tokens and PACS data.","analyst_note":"Confirm the default extension configuration and any non-patch mitigation at the NVD and GitHub advisory links for CVE-2026-118670.","how_to_check":"- Check the installed `@ohif/viewer` or OHIF app version and compare it with the fixed versions.\n- Look for the `dicom-pdf` extension in the deployed build and confirm its version.\n- unknown whether other check methods are published in the sources.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-affected-range","dicom-pdf-extension-not-loaded"],"who_is_affected":"Teams that run OHIF Viewers from 3.5.0-beta.0 up to the fixed versions, especially where users open DICOM files from shared PACS, DICOMweb sources or local files. Deployments that do not load the dicom-pdf extension or that run on a version outside the affected range are not exposed. unknown whether the sources name a default configuration that disables the extension.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000824,"input_tokens":4638,"output_tokens":720,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118670':15A,18A '-2026':14A,17A '1.2.840.10008.5.1.4.1.1.104.1':150C '3.12.15':108C,222C '3.13.7':109C,223C '3.14.0':111C,225C '3.5.0':105C 'access':185C 'allow':181C 'application/pdf':171C 'attack':121C,138C 'attacker-control':120C,137C 'auth':83B 'authent':188C 'beta.0':106C 'beta.19':112C,226C 'blob':132C,154C,161C,176C 'browser':62B 'byte':141C 'class':149C 'control':122C,139C 'craft':3A,56B 'cve':13A,16A 'despit':169C 'dicom':4A,19B,44B,57B,98C,115C,198C 'dicom-pdf':114C 'dicomweb':213C 'document':66B 'element':159C 'emb':152C 'embed':40B,65B,182C 'encapsul':146C 'encapsulateddocu':140C 'extens':102C,117C 'extensions/dicom-pdf/src/getsopclasshandlermodule.js':126C 'extensions/dicom-pdf/src/viewports/ohifcornerstonepdfviewport.tsx':151C 'file':37B,45B,53B 'fix':218C 'footprint':97C 'handl':166C 'healthcar':20B 'hint':173C 'host':28B 'html':68B,164C,168C 'imag':36B 'inherit':177C 'insid':42B 'issu':216C 'label':162C 'local':203C 'make':60B 'malici':197C 'may':200C 'media':133C 'medic':35B 'mime':48B 'mimetypeofencapsulateddocu':123C 'object':58B,158C,172C,199C 'ohif':1A,22B,29B,91C,179C 'ohif-view':21B 'open':145C,202C 'origin':12A,77B,88B,180C,193C 'pac':25B,89B,194C,208C 'packag':24B,103C 'pdf':5A,41B,116C,147C 'reach':80B 'read':118C 'render':38B 'request':90B,195C 'run':6A,72B 'same-origin':86B,191C 'script':7A,71B,183C 'self':27B 'self-host':26B 'session':81B,186C 'share':101C,207C 'sop':148C 'sourc':214C,220C 'storag':82B,187C 'suppli':210C 'taken':50B 'token':84B,189C 'treat':63B 'type':49B,134C 'upload':204C 'url':155C 'use':46B,128C 'valu':124C 'version':221C 'victim':144C 'viewer':2A,10A,23B,30B,33B,75B,92C,99C 'web':32B 'zero':96C 'zero-footprint':95C","nicknames":[],"mitigations":[],"who_affected":"Teams that run OHIF Viewers from 3.5.0-beta.0 up to the fixed versions, especially where users open DICOM files from shared PACS, DICOMweb sources or local files. Deployments that do not load the dicom-pdf extension or that run on a version outside the affected range are not exposed. unknown whether the sources name a default configuration that disables the extension.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dicom","healthcare","high","ohifviewers","package","pacs","selfhosted"],"campaign_type":null,"search_a":"'-118670':15A,18A '-2026':14A,17A 'craft':3A 'cve':13A,16A 'dicom':4A 'ohif':1A 'origin':12A 'pdf':5A 'run':6A 'script':7A 'viewer':2A,10A","search_b":"'auth':83B 'browser':62B 'craft':56B 'dicom':19B,44B,57B 'document':66B 'embed':40B,65B 'file':37B,45B,53B 'healthcar':20B 'host':28B 'html':68B 'imag':36B 'insid':42B 'make':60B 'medic':35B 'mime':48B 'object':58B 'ohif':22B,29B 'ohif-view':21B 'origin':77B,88B 'pac':25B,89B 'packag':24B 'pdf':41B 'reach':80B 'render':38B 'request':90B 'run':72B 'same-origin':86B 'script':71B 'self':27B 'self-host':26B 'session':81B 'storag':82B 'taken':50B 'token':84B 'treat':63B 'type':49B 'use':46B 'viewer':23B,30B,33B,75B 'web':32B","search_c":"'1.2.840.10008.5.1.4.1.1.104.1':150C '3.12.15':108C,222C '3.13.7':109C,223C '3.14.0':111C,225C '3.5.0':105C 'access':185C 'allow':181C 'application/pdf':171C 'attack':121C,138C 'attacker-control':120C,137C 'authent':188C 'beta.0':106C 'beta.19':112C,226C 'blob':132C,154C,161C,176C 'byte':141C 'class':149C 'control':122C,139C 'despit':169C 'dicom':98C,115C,198C 'dicom-pdf':114C 'dicomweb':213C 'element':159C 'emb':152C 'embed':182C 'encapsul':146C 'encapsulateddocu':140C 'extens':102C,117C 'extensions/dicom-pdf/src/getsopclasshandlermodule.js':126C 'extensions/dicom-pdf/src/viewports/ohifcornerstonepdfviewport.tsx':151C 'fix':218C 'footprint':97C 'handl':166C 'hint':173C 'html':164C,168C 'inherit':177C 'issu':216C 'label':162C 'local':203C 'malici':197C 'may':200C 'media':133C 'mimetypeofencapsulateddocu':123C 'object':158C,172C,199C 'ohif':91C,179C 'open':145C,202C 'origin':180C,193C 'pac':194C,208C 'packag':103C 'pdf':116C,147C 'read':118C 'request':195C 'same-origin':191C 'script':183C 'session':186C 'share':101C,207C 'sop':148C 'sourc':214C,220C 'storag':187C 'suppli':210C 'token':189C 'type':134C 'upload':204C 'url':155C 'use':128C 'valu':124C 'version':221C 'victim':144C 'viewer':92C,99C 'zero':96C 'zero-footprint':95C","first_public_at":"2026-10-29T17:22:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118670","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118670","severity":null,"published_at":"2026-11-06T18:17:57+00:00","modified_at":"2026-11-06T18:17:57+00:00","first_seen_at":"2026-11-06T18:44:08+00:00","fetched_at":"2026-11-06T18:44:08+00:00","note":null}],"documents":[{"id":88834,"url":"https://github.com/OHIF/Viewers/commit/db546701bd5f2be9031c835f1de5c40aacd3dc62","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88835,"url":"https://github.com/OHIF/Viewers/commit/ef0811c66cdb04ba07ffaba145cf66ce01486899","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88836,"url":"https://github.com/OHIF/Viewers/commit/f0dba789a313f40fe7e8a8cbec322a8d8a491d76","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88837,"url":"https://github.com/OHIF/Viewers/releases/tag/v3.12.15","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":88838,"url":"https://github.com/OHIF/Viewers/releases/tag/v3.13.7","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":88839,"url":"https://github.com/OHIF/Viewers/releases/tag/v3.14.0-beta.19","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":88840,"url":"https://github.com/OHIF/Viewers/security/advisories/GHSA-xwgp-w3pj-q5h3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T17:22:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}