VDB
Sign up
HIGH8.8

GHSA-wgrm-67xf-hhpq

PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

Quick fix

GHSA-wgrm-67xf-hhpq — pdfjs-dist: upgrade to the fixed version with the command below.

npm install pdfjs-dist@4.2.67

Details

### Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

### Patches The patch removes the use of `eval`: https://github.com/mozilla/pdf.js/pull/18015

### Workarounds Set the option `isEvalSupported` to `false`.

### References https://bugzilla.mozilla.org/show_bug.cgi?id=1893645

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/pdfjs-dist
Introduced in: 0Fixed in: 4.2.67
Fixnpm install pdfjs-dist@4.2.67

References