OHIF Viewers is a zero‑footprint DICOM viewer that relies on the dicom‑pdf extension to display PDF SOP Class files. In affected releases the extension reads a MIME type value supplied by an attacker and uses it as the media type for the document payload. If the attacker sets this MIME type to "text/html" the viewer embeds the resulting Blob URL in an object element. Because the Blob inherits the OHIF origin, the browser interprets the content as HTML and executes any embedded script. This gives the attacker a cross‑site scripting vector that can read session storage, fire authenticated PACS requests, and exfiltrate authentication tokens, effectively granting full authorization in the user’s OHIF session.

The issue applies to OHIF Viewers versions starting with 3.5.0-beta.0 and up to, but not including, the releases that contain the fix: 3.12.15, 3.13.7, and 3.14.0-beta.19. Users running any earlier or intermediate releases should consider them affected. The fix is available in the three listed releases and in any later version derived from them.

The vulnerability scores a CVSS of 8.8, classifying it as High. EPSS data is not available, and the flaw is not yet listed in the CISA KEV catalog. An attacker can exploit the flaw by creating a malicious DICOM object that includes the forged MIME type; the object can be opened locally, uploaded to a PACS system, or served from a DICOMweb source. Once open, the injected script runs with the same origin as the viewer, allowing theft of credentials and session data.