CVE-2026-30691
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt file. The TXTRenderer component fails to sanitize file content and explicitly casts raw data as a ReactNode.
Risk Assessment
An attacker can execute malicious scripts in the victim's browser context, potentially leading to session theft, data theft, or further attacks.
Recommendation
Update @cyntler/react-doc-viewer to a version that includes a fix for this vulnerability.
Original NVD description (English source)
Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt file. The TXTRenderer component fails to sanitize file content and explicitly casts raw data as a ReactNode