Docx Editor

v@eigenpal/[email protected] Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 1mo Developer Productivity

✓ No known CVEs patched

This release patches 3 known CVEs

Affected surfaces

auth rce_ssrf

Summary

AI summary

Fix Japanese/CJK IME input garbling in suggesting mode.

Full changelog

88a7650: Support RTL tables with w:bidiVisual alignment.
5ce3faa: Escape embedded font-family names before interpolating into the injected @font-face stylesheet, and build the print window via DOM APIs instead of document.write string concatenation. Prevents CSS injection and print-time XSS from crafted DOCX font names.
5eb0a43: Allowlist URL schemes on hyperlink and image-hyperlink targets parsed from DOCX relationships and pasted HTML; javascript:, data:, and other non-web schemes are now dropped.
673e917: Render RTL tables (w:bidiVisual) with their columns in visual right-to-left order, matching Word. The bidi flag was already parsed and round-tripped, but the on-page painter still drew columns left-to-right, so in a right-to-left table a label cell appeared on the wrong side of the field it labels.

Fixes #734
74e36ef: Build shape SVG via DOM APIs instead of innerHTML, preventing XSS from crafted DOCX shape attributes.
447d5b0: Fix Japanese/CJK IME input garbling text in suggesting mode. Composed text was re-inserted via handleTextInput, duplicating surrounding content and marking it as a tracked change. Suggesting mode now stays out of the way during composition and marks the committed text once it settles.

Prevent CSS injection and print‑time XSS from crafted DOCX font names (escape embedded font-family names)
Drop non‑web URL schemes (`javascript:`, `data:`) on hyperlinks and image‑hyperlink targets
Build shape SVG via DOM APIs to prevent XSS from crafted DOCX shape attributes

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Docx Editor

Get notified when new releases ship.

About Docx Editor

v@eigenpal/[email protected] Shared i18n package extracted into @eigenpal/docx-editor-i18n.
v@eigenpal/[email protected] `showPrintButton` prop removed from `<DocxEditor>` and toolbar components.
v@eigenpal/[email protected] Toolbar naming unified across React and Vue adapters; classic toolbar removed.
v@eigenpal/[email protected] Agent UI components relocated to new agent packages and API changed.
v@eigenpal/[email protected] Shared i18n package extracted from adapters into dedicated locale bundle.