CVE-2024-4367

HIGH8.8EPSS 40.3%

PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

Published: 5/7/2024Modified: 5/13/2026
Also known as:GHSA-wgrm-67xf-hhpqCGA-9prp-5j33-cxv9

Description

### Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. ### Patches The patch removes the use of `eval`: https://github.com/mozilla/pdf.js/pull/18015 ### Workarounds Set the option `isEvalSupported` to `false`. ### References https://bugzilla.mozilla.org/show_bug.cgi?id=1893645

Affected packages (9)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1HIGH8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References (18)