Vulnerability library
Security checkAugust 06, 2026

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

Understand the exposure, see the recommended fix, and check whether your own website has related weaknesses.

High severitynpmpdfjs-dist

Check your website

Find this and other vulnerabilities with a free scan.

Your scan runs on your computer. No account required.

Description

If PDF.js is used to load a malicious PDF, and PDF.js is configured with enableScripting set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

Recommendation

Update the pdfjs-dist package to the latest compatible version. Followings are version details:

  • Affected version(s): >= 5.6.83, < 6.2.108
  • Patched version(s): 6.2.108

References

Could your website be exposed too?

SmartScanner can check your website for PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF and gives you actionable findings to investigate.

Start a free scan

Related Issues

You might also like:

How to Secure your NodeJs Express Javascript Application - part 2

SmartScanner 2.3: Smarter JavaScript Detection, Faster Scans, and Powerful CLI Enhancements

How to Secure your NodeJs Express Javascript Application - part 1

See something that needs correcting? Let us knowUpdated August 06, 2026