HIGH

GHSA-hq66-cqwq-w95j

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

Quick fix

GHSA-hq66-cqwq-w95j — pdfjs-dist: upgrade to the fixed version with the command below.

npm install pdfjs-dist@6.2.108

Details

### Impact

If PDF.js is used to load a malicious PDF, and PDF.js is configured with `enableScripting` set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

### Patches

### Workarounds Set `enableScripting` to `false` or set a CSP.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / pdfjs-dist

Introduced in: 5.6.83 Fixed in: 6.2.108

Fix npm install pdfjs-dist@6.2.108

References

https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j [WEB]
https://bugzilla.mozilla.org/show_bug.cgi?id=2055885 [WEB]
https://github.com/mozilla/pdf.js [PACKAGE]