A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the OHIF Viewers' dicom-pdf extension when rendering Encapsulated PDF DICOM objects. The vulnerability arises from improper validation of the MIMETypeOfEncapsulatedDocument tag, allowing an attacker to control the MIME type of a Blob URL. This can lead to execution of attacker-supplied JavaScript in the context of the OHIF application origin when the victim opens a specially crafted DICOM study. The flaw affects versions prior to 3.12.18, 3.13.10, and 3.14.0-beta.36, with patches available in these and later versions.