PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

Description

If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

Recommendation

Update the pdfjs-dist package to the latest compatible version. Followings are version details:

Affected version(s): <= 4.1.392
Patched version(s): 4.2.67

References

GHSA-wgrm-67xf-hhpq
bugzilla.mozilla.org
lists.debian.org
www.mozilla.org
seclists.org
codeanlabs.com
www.exploit-db.com
cert-portal.siemens.com
CVE-2024-4367
CWE-754
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF and gives you actionable findings to investigate.

Start a free scan

Related Issues

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF - CVE-2026-16633
Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code - CVE-2023-45133
Svelecte item names vulnerable to execution of arbitrary JavaScript - CVE-2023-38687
Malicious PDF can inject JavaScript into PDF Viewer - CVE-2018-5158

How to Secure your NodeJs Express Javascript Application - part 2

SmartScanner 2.3: Smarter JavaScript Detection, Faster Scans, and Powerful CLI Enhancements

How to Secure your NodeJs Express Javascript Application - part 1

See something that needs correcting? Let us knowUpdated May 13, 2026