Go to packages list

pdfjs-dist

Ecosystem: npm

Downloads:

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 3HighAffects 4 versions
  • 0MediumAffects 0 versions
  • 0ModerateAffects 0 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
3vulnerabilities
  • Critical0 (0.0%)
  • High3 (100.0%)
  • Medium0 (0.0%)
  • Moderate0 (0.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (3)

Known vulnerabilities affecting pdfjs-dist, based on data from OSV.

Vulnerabilities affecting pdfjs-dist
IDSeveritySummaryAffected versionsPublishedSource
GHSA-hq66-cqwq-w95jHighPDF.js: Arbitrary JavaScript execution upon opening a malicious PDF### Impact If PDF.js is used to load a malicious PDF, and PDF.js is configured with `enableScripting` set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. ### Patches ### Workarounds Set `enableScripting` to `false` or set a CSP.
  • >= 5.6.83, < 6.2.108
GitHub (opens in a new tab)
GHSA-wgrm-67xf-hhpqHighPDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF### Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. ### Patches The patch removes the use of `eval`: https://github.com/mozilla/pdf.js/pull/18015 ### Workarounds Set the option `isEvalSupported` to `false`. ### References https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
  • < 4.2.67
GitHub (opens in a new tab)
GHSA-7jg2-jgv3-fmr4HighMalicious PDF can inject JavaScript into PDF ViewerThe PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability affects Firefox ESR < 52.8, Firefox < 60 and PDF.js < 2.0.550.
  • >= 2.0.0, < 2.0.550
  • < 1.10.100
GitHub (opens in a new tab)
  • GHSA-hq66-cqwq-w95jHigh
    PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF
    • >= 5.6.83, < 6.2.108
    GitHub (opens in a new tab)

    ### Impact If PDF.js is used to load a malicious PDF, and PDF.js is configured with `enableScripting` set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. ### Patches ### Workarounds Set `enableScripting` to `false` or set a CSP.

    CVE: CVE-2026-16633

  • GHSA-wgrm-67xf-hhpqHigh
    PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
    • < 4.2.67
    GitHub (opens in a new tab)

    ### Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. ### Patches The patch removes the use of `eval`: https://github.com/mozilla/pdf.js/pull/18015 ### Workarounds Set the option `isEvalSupported` to `false`. ### References https://bugzilla.mozilla.org/show_bug.cgi?id=1893645

    CVE: CVE-2024-4367

  • GHSA-7jg2-jgv3-fmr4High
    Malicious PDF can inject JavaScript into PDF Viewer
    • >= 2.0.0, < 2.0.550
    • < 1.10.100
    GitHub (opens in a new tab)

    The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability affects Firefox ESR < 52.8, Firefox < 60 and PDF.js < 2.0.550.

    CVE: CVE-2018-5158

Showing 1-3 of 3 vulnerabilities