[NPM:GHSA-WGRM-67XF-HHPQ] PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

  1. Home
  2. Security Advisories
  3. NPM
  4. NPM:GHSA-WGRM-67XF-HHPQ
Severity High
Affected Packages 1
Fixed Packages 1
CVEs 1
Info Packages References Vulnerabilities

Impact

If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

Patches

The patch removes the use of eval:
https://github.com/mozilla/pdf.js/pull/18015

Workarounds

Set the option isEvalSupported to false.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1893645

Package Affected Version
pkg:npm/pdfjs-dist <= 4.1.392
Package Fixed Version
pkg:npm/pdfjs-dist = 4.2.67
ID
NPM:GHSA-WGRM-67XF-HHPQ
Severity
high
URL
https://github.com/advisories/GHSA-wgrm-67xf-hhpq
Published
2024-05-07T10:25:08
(2 months ago)
Modified
2024-05-07T10:26:15
(2 months ago)
Rights
NPM Security Team
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:npm/pdfjs-dist pdfjs-dist <= 4.1.392
Fixed pkg:npm/pdfjs-dist pdfjs-dist = 4.2.67
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date