This vulnerability involves improper sanitization in the TXTRenderer component of @cyntler/react-doc-viewer v1.17.1. When rendering .txt files, the component treats raw file content as ReactNode without sanitization, enabling an attacker to inject and execute arbitrary JavaScript code via a crafted .txt file. This is a classic Cross-Site Scripting (XSS) flaw that could be exploited remotely. No patch or official fix information is currently available, and the vulnerability was published on 2026-05-20.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of the affected application using the vulnerable library. This can lead to typical XSS impacts such as session hijacking, defacement, or redirection to malicious sites. No evidence of active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid processing untrusted .txt files with the vulnerable TXTRenderer component or implement manual sanitization of file contents before rendering.