Description
The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability affects Firefox ESR < 52.8, Firefox < 60 and PDF.js < 2.0.550.
Recommendation
Update the pdfjs-dist package to the latest compatible version. Followings are version details:
Affected version(s): **< 1.10.100 >= 2.0.0, < 2.0.550** Patched version(s): **1.10.100 2.0.550**
References
Could your website be exposed too?
SmartScanner can check your website for Malicious PDF can inject JavaScript into PDF Viewer and gives you actionable findings to investigate.
Start a free scanRelated Issues
- PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF - CVE-2026-16633
- PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF - CVE-2024-4367
- Possible inject arbitrary `CSS` into the generated graph affecting the container HTML - CVE-2022-31108
- Matrix JavaScript SDK's key history sharing could share keys to malicious devices - CVE-2024-47080
You might also like:
See something that needs correcting? Let us knowUpdated May 28, 2024