Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @file-viewer/doc | npm | <= 2.3.0 | 2.3.1 |
| msdoc-viewer | npm | <= 0.2.1 | 0.2.2 |
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2026-91127 describes a DOM XSS issue in the legacy DOC renderer of the file-viewer library. Specifically, it allowed unsafe hyperlink schemes (e.g., javascript:, vbscript:, data:) and other malicious content (like font names) to be rendered without proper sanitization. The provided commit ef045680f8d9830a3eee9612f7df46a734361b07 is a security fix addressing this issue.
My analysis focused on the changes described in the CHANGELOG.md and the new test cases added in apps/viewer-demo/scripts/verify-renderer-sanitization.mjs. The changelog explicitly states that 'fonts, links, images, and attachment tags generated by @file-viewer/doc are encoded and protocol-restricted at the direct HTML API boundary' and that 'the standard mounting path uses DOMPurify 3.4.13 for in-depth sanitization before document HTML enters the DOM'.
The verify-renderer-sanitization.mjs file directly imports and tests mountMsDoc, renderMsDoc, and sanitizeMsDocLinkHref from @security/doc (which maps to packages/renderers/doc/src/index.ts). The extensive new test cases for various unsafe URL schemes and malicious content within this file provide strong evidence that these functions were directly involved in the vulnerability.
sanitizeMsDocLinkHref: This function is clearly responsible for validating and sanitizing link HREFs. Its previous lack of a URL-scheme allowlist was a direct cause of the XSS.renderMsDoc: This function is responsible for the initial rendering of the DOC content into HTML. It would have produced the unsanitized output containing the malicious schemes.mountMsDoc: This function is responsible for taking the rendered HTML and inserting it into the DOM. Without proper sanitization at this stage (now handled by DOMPurify), the malicious content would become active in the browser.sanitizeMsDocLinkHrefpackages/renderers/doc/src/index.ts
mountMsDocpackages/renderers/doc/src/index.ts
renderMsDocpackages/renderers/doc/src/index.ts