LOW GitHub
CVE-2026-46350
dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS
dcmjs, a JavaScript library for DICOM manipulation used in web-based medical
imaging viewers, contains an input validation bypass in its handling of DS
(Decimal String) and IS (Integer String) value representations.
The DecimalString and IntegerString classes in ValueRepresentation.js use a
regex sanitizer followed by JavaScript's Number() constructor. While the regex
strips direct NaN/Infinity strings, it preserves scientific notation (including
the 'e' character), enabling:
1. Infinity inj
Affected Products
- npm/dcmjs < 0.52.0
References
- https://github.com/advisories/GHSA-px68-xx5g-48q5
- https://github.com/dcmjs-org/dcmjs/security/advisories/GHSA-px68-xx5g-48q5
- https://github.com/dcmjs-org/dcmjs/commit/81e7e11cdefb56aa1a65bfe259648b865583ff88
- https://github.com/dcmjs-org/dcmjs/releases/tag/v0.52.0
This low severity vulnerability was published on 2026-10-27 via GitHub. Affected: npm/dcmjs < 0.52.0.
vulnfeed aggregates 18707 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.