Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
cvss
0.0
high
severity band, no base score published
epss
not scored
chance of exploitation in 30 days
xyz score
not scored
CyberXYZ composite out of 10
fig. 01 — GHSA-x7m8-jrm8-hpvx, the advisory selected below
// 1 advisories
GHSA-x7m8-jrm8-hpvx
HIGH
// summary
Embedded font-family names (word/fontTable.xml) were interpolated unescaped into an injected @font-face and into the print window's document.write(). A crafted name injects page-wide CSS on open, and breaks out of into executable HTML on Print.
// impact
Opening a crafted .docx applies attacker-controlled CSS page-wide with zero clicks (overlay/phishing, attribute-selector exfiltration of input values, tracking beacons). Clicking Print escalates to script execution in the embedder's origin.
// remediation
Upgrade to 1.8.3. Font names are CSS-escaped before interpolation (quotes, backslash, , and CSS newlines), and the print window is assembled with DOM APIs instead of document.write.
Checked 2026-09-26 at 01:02 UTC. The most recent advisory here was published 2026-09-10. Updated continuously from NVD, GHSA, OSV and CNA feeds.