GHSA-4m3g-6r7g-jv4f Arbitrary JavaScript execution due to using outdated libraries

• PyPI gradio_pdf: < 0.0.10 → fixed in 0.0.10

Summary gradio-pdf projects with dependencies on the pdf.js library are vulnerable to CVE-2024-4367, which allows arbitrary JavaScript execution. PoC 1. Generate a pdf file with a malicious script in the fontmatrix. (This will run `alert(‘XSS’)`.) poc.pdf 2. Run the app. In this PoC, I've used the demo for a simple proof. 3. Upload a PDF file containing the script. 4. Check that the script is running. Impact Malicious scripts can be injected into the code, and when linked with vulnerabilities such as CSRF, it can cause even greater damage. In particular, It can become a source of further attacks, especially when linked to social engineering. Mitigation Upgrade the pdf.js to v4.2.67, which removes the vulnerability. (or set the option `isEvalSupported` to `false`.) Reference 1. https://codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js/ 2. https://github.com/mozilla/pdf.js/pull/18015