GitHub Advisoryadvisory · npm

GHSA-wgrm-67xf-hhpq PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

HIGH Published 2024-05-07 Modified 2026-05-13 Official page ↗
Aliases
CVE-2024-4367
Ecosystem
npm
Packages
pdfjs-dist
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-754
Reviewed
2024-05-07

Affected packages

• npm pdfjs-dist: < 4.2.67 → fixed in 4.2.67

Description

Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. Patches The patch removes the use of `eval`: https://github.com/mozilla/pdf.js/pull/18015 Workarounds Set the option `isEvalSupported` to `false`. References https://bugzilla.mozilla.org/show_bug.cgi?id=1893645

Related

Alias · CVE (1)

  • CVE-2024-4367 A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. vulnerability

Weakness · CWE (1)

  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness

References