GitHub Advisoryadvisory · npm

GHSA-87hq-q4gp-9wr4 react-pdf vulnerable to arbitrary JavaScript execution upon opening a malicious PDF with PDF.js

HIGH Published 2024-05-07 Modified 2024-05-29 Official page ↗
Aliases
CVE-2024-34342
Ecosystem
npm
Packages
react-pdf
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Weaknesses
CWE-79
Reviewed
2024-05-07

Affected packages

• npm react-pdf: < 7.7.3 → fixed in 7.7.3 • npm react-pdf: >= 8.0.0, < 8.0.2 → fixed in 8.0.2

Description

Summary If PDF.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. Patches This patch forces `isEvalSupported` to `false`, removing the attack vector. Workarounds Set `options.isEvalSupported` to `false`, where `options` is `Document` component prop. References • GHSA-wgrm-67xf-hhpq • https://github.com/mozilla/pdf.js/pull/18015 • https://github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6 • https://bugzilla.mozilla.org/show_bug.cgi?id=1893645

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References