PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
Published 7 May 2024 · Updated 10 Sept 2026
Affected package
- Affected
- <4.2.67
- Fixed in
- 4.2.67
npm install pdfjs-dist@4.2.67Details
Impact
If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.
Patches
The patch removes the use of eval:
https://github.com/mozilla/pdf.js/pull/18015
Workarounds
Set the option isEvalSupported to false.
References
https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
Is GHSA-wgrm-67xf-hhpq in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected pdfjs-dist, and gives you the command that fixes it.
References
- Linkgithub.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq
- Advisorynvd.nist.gov/vuln/detail/CVE-2024-4367
- Linkgithub.com/gogs/gogs/issues/7928
- Linkgithub.com/mozilla/pdf.js/pull/18015
- Linkgithub.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6
- Linkbugzilla.mozilla.org/show_bug.cgi?id=1893645
- Linkcert-portal.siemens.com/productcert/html/ssa-827383.html
- Linkcodeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js
- Packagegithub.com/mozilla/pdf.js
- Linkgithub.com/mozilla/pdf.js/releases/tag/v4.2.67
- Linklists.debian.org/debian-lts-announce/2024/05/msg00010.html
- Linklists.debian.org/debian-lts-announce/2024/05/msg00012.html
- Linkwww.exploit-db.com/exploits/52273
- Linkwww.mozilla.org/security/advisories/mfsa2024-21
- Linkwww.mozilla.org/security/advisories/mfsa2024-22
- Linkwww.mozilla.org/security/advisories/mfsa2024-23
- Linkseclists.org/fulldisclosure/2024/Aug/30
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.