{"id":"CVE-2026-46350","revision":null,"records":[{"revision":"8529aef3d7bb424791fa255fc8244ed4","observedAt":"2026-10-27T14:09:44.115+00:00","statement":{"source":"osv","id":"GHSA-px68-xx5g-48q5","aliases":["CVE-2026-46350"],"title":"dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS","description":"dcmjs, a JavaScript library for DICOM manipulation used in web-based medical\nimaging viewers, contains an input validation bypass in its handling of DS\n(Decimal String) and IS (Integer String) value representations.\n\nThe DecimalString and IntegerString classes in ValueRepresentation.js use a\nregex sanitizer followed by JavaScript's Number() constructor. While the regex\nstrips direct NaN/Infinity strings, it preserves scientific notation (including\nthe 'e' character), enabling:\n\n  1. Infinity injection via scientific notation overflow (1e999999)\n  2. NaN injection via sign-only remnants from stripped inf strings (\"-inf\" -> \"-\")\n  3. IS accepting scientific notation in violation of PS3.5\n\nAFFECTED PRODUCT\n================\nProduct:          dcmjs (JavaScript DICOM manipulation library)\nRepository:       https://github.com/dcmjs-org/dcmjs\nnpm:              https://www.npmjs.com/package/dcmjs\nAffected Versions: < 0.52.0 (patched in 0.52.0, released 2026-05-19)\nCVE:              CVE-2026-46350 (assigned by GitHub 2026-05-13)\nCWE:              CWE-20 (Improper Input Validation)\nCVSS Score:       7.5 (HIGH)\nCVSS Vector:      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\nMaintainer note:  The CVSS score above is the reporter's assessment; dcmjs rates this low, because malformed input produces NaN/Infinity in values the caller must range-check in any case (both are reachable by other means, and no trust boundary enforced by dcmjs is crossed).\n\nDOWNSTREAM IMPACT\n=================\ndcmjs is a foundational library used by:\n  - OHIF Viewer (Open Health Imaging Foundation)\n  - Cornerstone.js ecosystem\n  - DICOMweb client/server implementations\n  - Research and clinical web-based PACS viewers\n  - Any Node.js or browser application parsing DICOM via dcmjs\n\nROOT CAUSE\n==========\nIn src/ValueRepresentation.js, both DecimalString and IntegerString use:\n\n    let returnVal = numberStr.trim().replace(/[^0-9.\\\\\\-+e]/gi, \"\");\n    return returnVal === \"\" ? null : Number(returnVal);\n\nThe regex /[^0-9.\\\\\\-+e]/gi strips characters NOT in the set {0-9, ., \\, -, +,\ne, E}. This provides partial defense: direct \"NaN\" and \"Infinity\" strings are\nstripped to empty/null. However:\n\n  (a) Scientific notation is fully preserved because 'e', digits, '+', '-', '.'\n      all pass the regex. \"1e999999\" passes intact, and Number(\"1e999999\")\n      returns JavaScript Infinity.\n\n  (b) The string \"-inf\" is stripped to just \"-\" (only the minus passes the\n      regex). Number(\"-\") returns JavaScript NaN.\n\n  (c) IntegerString uses the SAME regex/logic as DecimalString, meaning IS\n      accepts scientific notation (\"1e5\" -> 100000) in violation of PS3.5\n      Section 6.2, which restricts IS to characters 0-9, +, -.\n\n  (d) No range validation exists for IS values (PS3.5 requires [-2^31, 2^31-1])\n      or DS values (16-character max, fixed/floating-point only).\n\nVULNERABILITY DETAILS\n=====================\n\nAttack Vector 1: Infinity via Scientific Notation Overflow\n----------------------------------------------------------\nInput:   DS or IS field containing \"1e999999\"\nRegex:   Passes (all chars in allowed set)\nResult:  Number(\"1e999999\") -> Infinity\nImpact:  Infinity propagates through all downstream arithmetic\n\nAttack Vector 2: Negative Infinity via Scientific Notation\n----------------------------------------------------------\nInput:   DS or IS field containing \"-1e999999\"\nRegex:   Passes\nResult:  Number(\"-1e999999\") -> -Infinity\nImpact:  Negative Infinity in spatial/dosimetric calculations\n\nAttack Vector 3: NaN via Sign-Only Remnant\n------------------------------------------\nInput:   DS or IS field containing \"-inf\"\nRegex:   Strips to \"-\"\nResult:  Number(\"-\") -> NaN\nImpact:  NaN propagates silently through arithmetic (IEEE 754)\n\nAttack Vector 4: NaN via Plus-Only Remnant\n------------------------------------------\nInput:   DS or IS field containing \"+inf\"\nRegex:   Strips to \"+\"\nResult:  Number(\"+\") -> NaN\nImpact:  Same as above\n\nAttack Vector 5: IS Scientific Notation Bypass\n-----------------------------------------------\nInput:   IS field containing \"1e5\"\nRegex:   Passes\nResult:  Number(\"1e5\") -> 100000\nImpact:  Integer fields accept non-integer representation, violating PS3.5\n\nAttack Vector 6: IS Extreme Overflow\n-------------------------------------\nInput:   IS field containing \"1e18\"\nRegex:   Passes\nResult:  Number(\"1e18\") -> 1000000000000000000\nImpact:  Far exceeds IS range [-2^31, 2^31-1], no bounds check\n\nCLINICAL IMPACT\n===============\ndcmjs is used in web-based DICOM viewers and processing pipelines.\nCorrupted values affect:\n\n  - PixelSpacing / ImagePositionPatient: Spatial geometry corruption prevents\n    accurate measurement and registration in web viewers\n\n  - WindowCenter / WindowWidth: Display pipeline corruption makes images\n    unreadable (all black or all white)\n\n  - DoseGridScaling / NumberOfFrames: Radiation therapy dose display errors\n    and denial of service via frame count overflow\n\n  - RescaleSlope / RescaleIntercept: Hounsfield unit conversion produces\n    invalid values, corrupting quantitative analysis\n\n  - SliceThickness: Volume reconstruction fails in multiplanar reformats","state":0,"publishedAt":"2026-10-27T13:29:57+00:00","modifiedAt":"2026-10-27T13:45:03.4637798+00:00","affected":[{"ecosystem":"npm","name":"dcmjs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.52.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/dcmjs-org/dcmjs/security/advisories/GHSA-px68-xx5g-48q5","https://github.com/dcmjs-org/dcmjs/commit/81e7e11cdefb56aa1a65bfe259648b865583ff88","https://github.com/dcmjs-org/dcmjs","https://github.com/dcmjs-org/dcmjs/releases/tag/v0.52.0"],"sourceUrl":"https://github.com/advisories/GHSA-px68-xx5g-48q5","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-px68-xx5g-48q5","identifiers":["GHSA-px68-xx5g-48q5","CVE-2026-46350"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-30T17:47:19.2047395+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-10-30T17:47:19.2047395+00:00","lastSuccessAt":"2026-10-30T17:47:19.437838+00:00","error":null,"lastVerifiedAt":"2026-10-30T17:47:19.4378398+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7e2c4e7288f2c464ad8c61f3bb6017374714faedcc781283ac06a706ee1a820b-eaf386bcc66750862089c53dbb20b94f352d28d45e3680ead39fc42a5a1efb8b","complete":true,"records":417249,"lastAttemptAt":"2026-10-30T17:45:32.5658953+00:00","lastSuccessAt":"2026-10-30T17:45:32.4016715+00:00","error":null,"lastVerifiedAt":"2026-10-30T17:45:32.5658953+00:00","snapshotPublishedAt":"2026-10-30T17:26:34+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b5bdbed2ea474c69ac8422d30af3b4df","complete":false,"records":13527,"lastAttemptAt":"2026-10-30T17:59:12.5592535+00:00","lastSuccessAt":"2026-10-30T17:59:12.555+00:00","error":"74 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-10-30T17:59:12.555+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":12184,"expectedIdentifiers":13605,"failedIdentifiers":74},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-30T17:47:19.2047395+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-30T17:47:19.2047395+00:00","lastSuccessAt":"2026-10-30T17:47:19.4387295+00:00","error":null,"lastVerifiedAt":"2026-10-30T17:47:19.4387297+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d5ef5319f3714a85a06758c8734f5837","complete":true,"records":13545,"lastAttemptAt":"2026-10-30T17:47:26.3305118+00:00","lastSuccessAt":"2026-10-30T17:47:26.327+00:00","error":null,"lastVerifiedAt":"2026-10-30T17:47:26.327+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13605,"expectedIdentifiers":13605,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-e091d9104aae1991994c868b5fad0248c9b288abafb7672fca8ae6500f97e080","complete":true,"records":9808,"lastAttemptAt":"2026-10-30T17:47:15.4481935+00:00","lastSuccessAt":"2026-10-30T15:47:48.5635219+00:00","error":null,"lastVerifiedAt":"2026-10-30T17:47:15.4481935+00:00","snapshotPublishedAt":"2026-10-30T15:23:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-10-30T17:45:32.7901767+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-10-30T17:45:32.7901767+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f7956b0b80c3f12706a4454a1e0aea0c83c0a5730f2cff4597eb5c4eedd05097","complete":true,"records":3023,"lastAttemptAt":"2026-10-30T17:47:19.1649024+00:00","lastSuccessAt":"2026-10-30T17:47:18.9941876+00:00","error":null,"lastVerifiedAt":"2026-10-30T17:47:19.1649024+00:00","snapshotPublishedAt":"2026-10-30T15:48:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-b9c945c1be5e959f6f291c11846a0289b1f1b6add5c591c5cee830369a9f6ce3","complete":true,"records":230957,"lastAttemptAt":"2026-10-30T17:47:15.3068735+00:00","lastSuccessAt":"2026-10-30T17:47:13.9486259+00:00","error":null,"lastVerifiedAt":"2026-10-30T17:47:15.3068735+00:00","snapshotPublishedAt":"2026-10-30T17:34:03+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}