HighGHSA-hq66-cqwq-w95jCVE-2026-16633

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

Published 6 Aug 2026 · Updated 10 Sept 2026

Affected package

Affected: >=5.6.83 <6.2.108
Fixed in: 6.2.108

Update to the fixed version for your release line, for example:npm install pdfjs-dist@6.2.108

Details

Impact

If PDF.js is used to load a malicious PDF, and PDF.js is configured with enableScripting set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

Patches

Workarounds

Set enableScripting to false or set a CSP.

Is GHSA-hq66-cqwq-w95j in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected pdfjs-dist, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.