A high-severity cross-site scripting vulnerability in flyfish-dev file-viewer allows attackers to execute arbitrary code in the context of the user session through malicious legacy DOC files.

This vulnerability is a cross-site scripting (XSS) flaw where the document renderer fails to validate URL schemes within hyperlinks. An unauthenticated attacker can craft a legacy DOC file containing javascript or other unsafe URI schemes, which will execute when a user interacts with the link within the application.

The ability to execute arbitrary scripts in the embedding application origin poses a significant risk to data confidentiality and integrity. An attacker could potentially steal session tokens, perform actions on behalf of the user, or access sensitive information displayed within the web application. Given the CVSS score of 8.2, this vulnerability represents a high risk that could lead to full account compromise or unauthorized data access if exploited in an internal environment.

Immediate Action: Update @file-viewer/doc to version 2.3.1 and msdoc-viewer to version 0.2.2 immediately to implement the required URL scheme restrictions and sanitization.

Proactive Monitoring: Monitor application logs for unusual hyperlink interaction patterns or anomalous outbound traffic originating from the document viewer component.

Compensating Controls: Implement a strict Content Security Policy (CSP) that restricts script execution sources and prevents the use of inline scripts to mitigate the impact of potential XSS attacks.

Public Exploit Available: No

This vulnerability is serious due to its potential for remote code execution via the browser origin. Organizations utilizing the flyfish-dev file-viewer library must prioritize the identified package updates to ensure that document-controlled links are properly sanitized and restricted to safe schemes. Failure to apply these patches leaves users vulnerable to script injection attacks that can bypass standard security boundaries.