GHSA-PX68-XX5G-48Q5
Vulnerability from github – Published: 2026-10-27 13:29 – Updated: 2026-10-27 13:29dcmjs, a JavaScript library for DICOM manipulation used in web-based medical imaging viewers, contains an input validation bypass in its handling of DS (Decimal String) and IS (Integer String) value representations.
The DecimalString and IntegerString classes in ValueRepresentation.js use a regex sanitizer followed by JavaScript's Number() constructor. While the regex strips direct NaN/Infinity strings, it preserves scientific notation (including the 'e' character), enabling:
- Infinity injection via scientific notation overflow (1e999999)
- NaN injection via sign-only remnants from stripped inf strings ("-inf" -> "-")
- IS accepting scientific notation in violation of PS3.5
AFFECTED PRODUCT
Product: dcmjs (JavaScript DICOM manipulation library) Repository: https://github.com/dcmjs-org/dcmjs npm: https://www.npmjs.com/package/dcmjs Affected Versions: < 0.52.0 (patched in 0.52.0, released 2026-05-19) CVE: CVE-2026-46350 (assigned by GitHub 2026-05-13) CWE: CWE-20 (Improper Input Validation) CVSS Score: 7.5 (HIGH) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Maintainer note: The CVSS score above is the reporter's assessment; dcmjs rates this low, because malformed input produces NaN/Infinity in values the caller must range-check in any case (both are reachable by other means, and no trust boundary enforced by dcmjs is crossed).
DOWNSTREAM IMPACT
dcmjs is a foundational library used by: - OHIF Viewer (Open Health Imaging Foundation) - Cornerstone.js ecosystem - DICOMweb client/server implementations - Research and clinical web-based PACS viewers - Any Node.js or browser application parsing DICOM via dcmjs
ROOT CAUSE
In src/ValueRepresentation.js, both DecimalString and IntegerString use:
let returnVal = numberStr.trim().replace(/[^0-9.\\\-+e]/gi, "");
return returnVal === "" ? null : Number(returnVal);
The regex /[^0-9.\-+e]/gi strips characters NOT in the set {0-9, ., \, -, +, e, E}. This provides partial defense: direct "NaN" and "Infinity" strings are stripped to empty/null. However:
(a) Scientific notation is fully preserved because 'e', digits, '+', '-', '.' all pass the regex. "1e999999" passes intact, and Number("1e999999") returns JavaScript Infinity.
(b) The string "-inf" is stripped to just "-" (only the minus passes the regex). Number("-") returns JavaScript NaN.
(c) IntegerString uses the SAME regex/logic as DecimalString, meaning IS accepts scientific notation ("1e5" -> 100000) in violation of PS3.5 Section 6.2, which restricts IS to characters 0-9, +, -.
(d) No range validation exists for IS values (PS3.5 requires [-2^31, 2^31-1]) or DS values (16-character max, fixed/floating-point only).
VULNERABILITY DETAILS
Attack Vector 1: Infinity via Scientific Notation Overflow
Input: DS or IS field containing "1e999999" Regex: Passes (all chars in allowed set) Result: Number("1e999999") -> Infinity Impact: Infinity propagates through all downstream arithmetic
Attack Vector 2: Negative Infinity via Scientific Notation
Input: DS or IS field containing "-1e999999" Regex: Passes Result: Number("-1e999999") -> -Infinity Impact: Negative Infinity in spatial/dosimetric calculations
Attack Vector 3: NaN via Sign-Only Remnant
Input: DS or IS field containing "-inf" Regex: Strips to "-" Result: Number("-") -> NaN Impact: NaN propagates silently through arithmetic (IEEE 754)
Attack Vector 4: NaN via Plus-Only Remnant
Input: DS or IS field containing "+inf" Regex: Strips to "+" Result: Number("+") -> NaN Impact: Same as above
Attack Vector 5: IS Scientific Notation Bypass
Input: IS field containing "1e5" Regex: Passes Result: Number("1e5") -> 100000 Impact: Integer fields accept non-integer representation, violating PS3.5
Attack Vector 6: IS Extreme Overflow
Input: IS field containing "1e18" Regex: Passes Result: Number("1e18") -> 1000000000000000000 Impact: Far exceeds IS range [-2^31, 2^31-1], no bounds check
CLINICAL IMPACT
dcmjs is used in web-based DICOM viewers and processing pipelines. Corrupted values affect:
-
PixelSpacing / ImagePositionPatient: Spatial geometry corruption prevents accurate measurement and registration in web viewers
-
WindowCenter / WindowWidth: Display pipeline corruption makes images unreadable (all black or all white)
-
DoseGridScaling / NumberOfFrames: Radiation therapy dose display errors and denial of service via frame count overflow
-
RescaleSlope / RescaleIntercept: Hounsfield unit conversion produces invalid values, corrupting quantitative analysis
-
SliceThickness: Volume reconstruction fails in multiplanar reformats
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "dcmjs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.52.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-46350"
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-27T13:29:57Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "dcmjs, a JavaScript library for DICOM manipulation used in web-based medical\nimaging viewers, contains an input validation bypass in its handling of DS\n(Decimal String) and IS (Integer String) value representations.\n\nThe DecimalString and IntegerString classes in ValueRepresentation.js use a\nregex sanitizer followed by JavaScript\u0027s Number() constructor. While the regex\nstrips direct NaN/Infinity strings, it preserves scientific notation (including\nthe \u0027e\u0027 character), enabling:\n\n 1. Infinity injection via scientific notation overflow (1e999999)\n 2. NaN injection via sign-only remnants from stripped inf strings (\"-inf\" -\u003e \"-\")\n 3. IS accepting scientific notation in violation of PS3.5\n\nAFFECTED PRODUCT\n================\nProduct: dcmjs (JavaScript DICOM manipulation library)\nRepository: https://github.com/dcmjs-org/dcmjs\nnpm: https://www.npmjs.com/package/dcmjs\nAffected Versions: \u003c 0.52.0 (patched in 0.52.0, released 2026-05-19)\nCVE: CVE-2026-46350 (assigned by GitHub 2026-05-13)\nCWE: CWE-20 (Improper Input Validation)\nCVSS Score: 7.5 (HIGH)\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\nMaintainer note: The CVSS score above is the reporter\u0027s assessment; dcmjs rates this low, because malformed input produces NaN/Infinity in values the caller must range-check in any case (both are reachable by other means, and no trust boundary enforced by dcmjs is crossed).\n\nDOWNSTREAM IMPACT\n=================\ndcmjs is a foundational library used by:\n - OHIF Viewer (Open Health Imaging Foundation)\n - Cornerstone.js ecosystem\n - DICOMweb client/server implementations\n - Research and clinical web-based PACS viewers\n - Any Node.js or browser application parsing DICOM via dcmjs\n\nROOT CAUSE\n==========\nIn src/ValueRepresentation.js, both DecimalString and IntegerString use:\n\n let returnVal = numberStr.trim().replace(/[^0-9.\\\\\\-+e]/gi, \"\");\n return returnVal === \"\" ? null : Number(returnVal);\n\nThe regex /[^0-9.\\\\\\-+e]/gi strips characters NOT in the set {0-9, ., \\, -, +,\ne, E}. This provides partial defense: direct \"NaN\" and \"Infinity\" strings are\nstripped to empty/null. However:\n\n (a) Scientific notation is fully preserved because \u0027e\u0027, digits, \u0027+\u0027, \u0027-\u0027, \u0027.\u0027\n all pass the regex. \"1e999999\" passes intact, and Number(\"1e999999\")\n returns JavaScript Infinity.\n\n (b) The string \"-inf\" is stripped to just \"-\" (only the minus passes the\n regex). Number(\"-\") returns JavaScript NaN.\n\n (c) IntegerString uses the SAME regex/logic as DecimalString, meaning IS\n accepts scientific notation (\"1e5\" -\u003e 100000) in violation of PS3.5\n Section 6.2, which restricts IS to characters 0-9, +, -.\n\n (d) No range validation exists for IS values (PS3.5 requires [-2^31, 2^31-1])\n or DS values (16-character max, fixed/floating-point only).\n\nVULNERABILITY DETAILS\n=====================\n\nAttack Vector 1: Infinity via Scientific Notation Overflow\n----------------------------------------------------------\nInput: DS or IS field containing \"1e999999\"\nRegex: Passes (all chars in allowed set)\nResult: Number(\"1e999999\") -\u003e Infinity\nImpact: Infinity propagates through all downstream arithmetic\n\nAttack Vector 2: Negative Infinity via Scientific Notation\n----------------------------------------------------------\nInput: DS or IS field containing \"-1e999999\"\nRegex: Passes\nResult: Number(\"-1e999999\") -\u003e -Infinity\nImpact: Negative Infinity in spatial/dosimetric calculations\n\nAttack Vector 3: NaN via Sign-Only Remnant\n------------------------------------------\nInput: DS or IS field containing \"-inf\"\nRegex: Strips to \"-\"\nResult: Number(\"-\") -\u003e NaN\nImpact: NaN propagates silently through arithmetic (IEEE 754)\n\nAttack Vector 4: NaN via Plus-Only Remnant\n------------------------------------------\nInput: DS or IS field containing \"+inf\"\nRegex: Strips to \"+\"\nResult: Number(\"+\") -\u003e NaN\nImpact: Same as above\n\nAttack Vector 5: IS Scientific Notation Bypass\n-----------------------------------------------\nInput: IS field containing \"1e5\"\nRegex: Passes\nResult: Number(\"1e5\") -\u003e 100000\nImpact: Integer fields accept non-integer representation, violating PS3.5\n\nAttack Vector 6: IS Extreme Overflow\n-------------------------------------\nInput: IS field containing \"1e18\"\nRegex: Passes\nResult: Number(\"1e18\") -\u003e 1000000000000000000\nImpact: Far exceeds IS range [-2^31, 2^31-1], no bounds check\n\nCLINICAL IMPACT\n===============\ndcmjs is used in web-based DICOM viewers and processing pipelines.\nCorrupted values affect:\n\n - PixelSpacing / ImagePositionPatient: Spatial geometry corruption prevents\n accurate measurement and registration in web viewers\n\n - WindowCenter / WindowWidth: Display pipeline corruption makes images\n unreadable (all black or all white)\n\n - DoseGridScaling / NumberOfFrames: Radiation therapy dose display errors\n and denial of service via frame count overflow\n\n - RescaleSlope / RescaleIntercept: Hounsfield unit conversion produces\n invalid values, corrupting quantitative analysis\n\n - SliceThickness: Volume reconstruction fails in multiplanar reformats",
"id": "GHSA-px68-xx5g-48q5",
"modified": "2026-10-27T13:29:57Z",
"published": "2026-10-27T13:29:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dcmjs-org/dcmjs/security/advisories/GHSA-px68-xx5g-48q5"
},
{
"type": "WEB",
"url": "https://github.com/dcmjs-org/dcmjs/commit/81e7e11cdefb56aa1a65bfe259648b865583ff88"
},
{
"type": "PACKAGE",
"url": "https://github.com/dcmjs-org/dcmjs"
},
{
"type": "WEB",
"url": "https://github.com/dcmjs-org/dcmjs/releases/tag/v0.52.0"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.