GHSA-x7m8-jrm8-hpvx @eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name
Attackers can inject CSS or execute scripts via crafted font names in .docx files, leading to data exfiltration or code execution when users open or print documents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-x7m8-jrm8-hpvx?
GHSA-x7m8-jrm8-hpvx is a cross-site scripting vulnerability in @eigenpal/docx-editor-core, published on 10 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Summary
Embedded font-family names (word/fontTable.xml) were interpolated unescaped into an injected @font-face <style> and into the print window's document.write(). A crafted name injects page-wide CSS on open, and breaks out of <style>
into executable HTML on Print.
Impact
Opening a crafted .docx applies attacker-controlled CSS page-wide with zero clicks (overlay/phishing, attribute-selector exfiltration of input values, tracking beacons). Clicking Print escalates to script execution in the embedder's origin.
Remediation
Upgrade to 1.8.3. Font names are CSS-escaped before interpolation (quotes, backslash, < >, and CSS newlines), and the print window is assembled with DOM APIs instead of document.write.
Which versions are affected by GHSA-x7m8-jrm8-hpvx?
4 open source packages ship an affected version, including @eigenpal/docx-editor-core and @eigenpal/docx-editor-react.
| Package | Affected | Fixed in |
|---|---|---|
@eigenpal/docx-editor-core npm | All versions | 1.8.3 |
@eigenpal/docx-editor-core npm | All versions | 1.8.3 |
@eigenpal/docx-editor-react npm | All versions | 1.8.3 |
@eigenpal/docx-editor-react npm | All versions | 1.8.3 |
How do I fix GHSA-x7m8-jrm8-hpvx?
Upgrade @eigenpal/docx-editor-core to 1.8.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-x7m8-jrm8-hpvx being exploited?
There is no known exploitation of GHSA-x7m8-jrm8-hpvx in the wild and no public exploit code.