Docx Editor

v@eigenpal/[email protected] Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Developer Productivity

✓ No known CVEs patched

This release patches 1 known CVE

Affected surfaces

rce_ssrf

Summary

AI summary

Regex handling for file- and library-supplied strings now runs in linear time and fully escapes quoted font names to prevent injection.

Full changelog

28876a2: Make regular expressions over file- and library-supplied strings run in linear time and escape quoted font names completely. The variable-detection, plural-message, and core-properties date regexes no longer backtrack polynomially on hostile input, and font family names are now backslash-escaped before being wrapped in a quoted CSS string so a crafted DOCX font name cannot break out of it.

Regex handling now linear‑time and fully escapes quoted font names, preventing injection attacks

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Docx Editor

Get notified when new releases ship.

About Docx Editor

v@eigenpal/[email protected] Shared i18n package extracted into @eigenpal/docx-editor-i18n.
v@eigenpal/[email protected] `showPrintButton` prop removed from `<DocxEditor>` and toolbar components.
v@eigenpal/[email protected] Toolbar naming unified across React and Vue adapters; classic toolbar removed.
v@eigenpal/[email protected] Agent UI components relocated to new agent packages and API changed.
v@eigenpal/[email protected] Shared i18n package extracted from adapters into dedicated locale bundle.