Docx Editor

v@eigenpal/[email protected] Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo Developer Productivity

✓ No known CVEs patched

This release patches 2 known CVEs

Affected surfaces

auth rce_ssrf

Summary

AI summary

Harden print window to prevent document title injection and remove two denial‑of‑service input paths.

Full changelog

f61435b: Harden openPrintWindow to build the print window via DOM APIs instead of document.write, so a crafted document title cannot break out into executable markup. The framework-agnostic print helpers are now exported from @eigenpal/docx-editor-core as the single source of truth, and the React package re-exports them unchanged.
791b132: Remove two potential slow-input denial-of-service paths in the React adapter. The data URL MIME parser now uses index math instead of a backtracking regex, and the toolbar test-id helper no longer scans across unmatched parentheses, so neither degrades on long crafted input.
Updated dependencies [4b47daf]
Updated dependencies [9144b69]
Updated dependencies [826aa32]
Updated dependencies [826aa32]
Updated dependencies [12c1f87]
Updated dependencies [7839ee9]
Updated dependencies [826aa32]
Updated dependencies [9454c9a]
Updated dependencies [f61435b]
Updated dependencies [28876a2]
- @eigenpal/[email protected]
- @eigenpal/[email protected]
- @eigenpal/[email protected]

Harden `openPrintWindow` to prevent document title injection via `document.write` (DOM APIs only)
Remove two denial‑of‑service paths: data URL MIME parser uses index math instead of backtracking regex; toolbar test‑id helper no longer scans unmatched parentheses

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Docx Editor

Get notified when new releases ship.

About Docx Editor

v@eigenpal/[email protected] Shared i18n package extracted into @eigenpal/docx-editor-i18n.
v@eigenpal/[email protected] `showPrintButton` prop removed from `<DocxEditor>` and toolbar components.
v@eigenpal/[email protected] Toolbar naming unified across React and Vue adapters; classic toolbar removed.
v@eigenpal/[email protected] Agent UI components relocated to new agent packages and API changed.
v@eigenpal/[email protected] Shared i18n package extracted from adapters into dedicated locale bundle.