The flyfish-dev file-viewer component, used for browser-native viewing of various file types, had a vulnerability in its legacy DOC renderer. Before versions @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the renderer emitted document-controlled hyperlink targets into generated HTML with character escaping but without restricting URL schemes. This allowed crafted DOC files to embed unsafe schemes like javascript:, vbscript:, or data:, leading to cross-site scripting when users clicked these links. The fix implemented blocks external document links by default, permits only HTTP(S), mailto, telephone, safe relative URLs, and internal bookmarks when external links are enabled, and adds mount-boundary sanitization as a defense in depth measure.

Successful exploitation allows an attacker to execute script in the context of the embedding application's origin when a user clicks a malicious link in a legacy DOC file. This can lead to partial confidentiality compromise (C:H), limited integrity impact (I:L), and no availability impact (A:N). The vulnerability requires user interaction (UI:R) and can be exploited remotely without privileges (AV:N, PR:N).

This vulnerability is fixed in @file-viewer/doc version 2.3.1 and msdoc-viewer version 0.2.2. Users and administrators should upgrade to these versions or later to remediate the issue. No additional mitigation is required once updated. Patch status is confirmed by the vendor advisory.