Docx Editor

v@eigenpal/[email protected] Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Developer Productivity

✓ No known CVEs patched

This release patches 1 known CVE

Affected surfaces

auth rce_ssrf

Summary

AI summary

Escape embedded font-family names to prevent CSS injection and print-time XSS.

Full changelog

5ce3faa: Escape embedded font-family names before interpolating into the injected @font-face stylesheet, and build the print window via DOM APIs instead of document.write string concatenation. Prevents CSS injection and print-time XSS from crafted DOCX font names.
Updated dependencies [88a7650]
Updated dependencies [5ce3faa]
Updated dependencies [5eb0a43]
Updated dependencies [673e917]
Updated dependencies [74e36ef]
Updated dependencies [447d5b0]
- @eigenpal/[email protected]
- @eigenpal/[email protected]
- @eigenpal/[email protected]

Escape embedded font-family names before interpolating into the injected `@font-face` stylesheet; build print window via DOM APIs instead of `document.write` to prevent CSS injection and print-time XSS.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Docx Editor

Get notified when new releases ship.

About Docx Editor

v@eigenpal/[email protected] Shared i18n package extracted into @eigenpal/docx-editor-i18n.
v@eigenpal/[email protected] `showPrintButton` prop removed from `<DocxEditor>` and toolbar components.
v@eigenpal/[email protected] Toolbar naming unified across React and Vue adapters; classic toolbar removed.
v@eigenpal/[email protected] Agent UI components relocated to new agent packages and API changed.
v@eigenpal/[email protected] Shared i18n package extracted from adapters into dedicated locale bundle.