Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the pdfjs-1.4.20 component under public/plugins/. An attacker can execute arbitrary JavaScript code in the context of the user's browser by injecting malicious scripts into PDF files rendered by the...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the pdfjs-1.4.20 component under public/plugins/. An attacker can execute arbitrary JavaScript code in the context of the user's browser by injecting malicious scripts into PDF files rendered by the...

CVE-2025-47943

Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting XSS vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usage of a vulnerable and outdated componen...

CVE-2025-47943 Gogs stored XSS in PDF renderer

Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting XSS vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usage of a vulnerable and outdated componen...

CVE-2025-47943 Gogs stored XSS in PDF renderer

Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting XSS vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usage of a vulnerable and outdated componen...

PT-2025-26689 · Pdf.Js +1 · Pdf.Js +1

Name of the Vulnerable Software and Affected Versions: Gogs versions 0.14.0+dev and prior Description: Gogs is an open source self-hosted Git service. The issue is a stored cross-site scripting XSS vulnerability, which allows client-side Javascript code execution. This is caused by the usage of a...

Gogs 安全漏洞

Gogs Go Git Service is a self-service Git hosting service based on Go language by the Gogs team, which supports creating and migrating public/private repositories, adding and deleting repository collaborators, and so on. A security vulnerability exists in Gogs 0.14.0+dev and earlier versions, whi...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in pdfjs-dist

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of pdfjs-dist Vulnerability Details CVEID:CVE-2024-4367 DESCRIPTION: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This...

Script execution via PDF as attachment - CVE-2021-39111

The attachment as PDF is a vulnerable PDFJS library. To confirm the vulnerability, we uploaded a PDF file containing a JavaScript. After opening a preview of the PDF file, the console displayed the message "Hello, xss is working," indicating that the JavaScript code had been successfully executed...

firefox: thunderbird: Cross-origin access to PDF contents through multipart responses

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the issue as follows: An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the resource://pdf.js origin. This could allow them to access cross-origin PDF content. This...

Gitlab -- Vulnerabilities

Gitlab reports: 1-click account takeover via XSS in the code editor in gitlab.com A DOS vulnerability in the 'description' field of the runner CSRF via K8s cluster-integration Using Set Pipeline Status of a Commit API incorrectly create a new pipeline when SHA and pipelineid did not match Redos o...

SUSE CVE-2024-4367

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11...

Remote Code Execution (RCE)

pdfjs-dist is vulnerable to Remote Code Execution RCE. The vulnerability is due to the default setting isEvalSupported set to true, which allows unrestricted execution of attacker-controlled JavaScript within the hosting domain context...

@aidc/chat-ui-plugin-knowledge (>=0.5.43-beta.0, <=0.5.44), @aidc/saas-ui (>=0.5.43-beta.0, <=0.5.44) +23 more potentially affected by CVE-2024-34342 +1 more via pdfjs-dist (>=4.0.189, <=4.1.392)

pdfjs-dist NPM version =4.0.189, =0.5.43-beta.0, =0.5.43-beta.0, =0.5.43-beta.0, =0.5.43-beta.0, =0.5.43-beta.0, =8.0.0, =0.0.0-test, =1.8.4-beta.1, =0.2.1, =1.0.4, =1.6.0-dev.0-update-pdfjs-dist, =1.4.0, =1.5.1 and more Source cves: CVE-2024-34342, CVE-2024-4367 Source advisory:...

@alfresco/adf-content-services (>=2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, <=2.5.0-ffef7688d7d5b9a2827d4427d416d0b5b2f377d4), @alfresco/adf-core (>=2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, <=2.5.0-ffef7688d7d5b9a2827d4427d416d0b5b2f377d4) +200 more potentially affected by CVE-2018-5158 via pdfjs-dist (>=1.2.113, <=1.10.97)

pdfjs-dist NPM version =1.2.113, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =0.0.1, =1.0.0, =1.2.1, =1.0.34, =1.2.1-a, =1.0.0, =1.2.2, =0.0.7,...

@accoio/react-pdf-highlighter (>=2.0.0, <=2.0.1), @activelylearn/react-pdf (>=2.5.0, <=2.5.2) +97 more potentially affected by CVE-2018-5158 via pdfjs-dist (>=2.0.104, <=2.0.489)

pdfjs-dist NPM version =2.0.104, =2.0.0, =2.5.0, =1.0.32, =1.2.0, =15.0.0, =6.0.0, =39.0.0, =7.0.0, =110.0.0, =7.0.0, =6.0.0, =3.0.6, =8.0.0, =9.0.0, =4.0.9, =4.2.1 and more Source cves: CVE-2018-5158 Source advisory: OSV:GHSA-7JG2-JGV3-FMR4...

@toolspack/ttd-common (>=0.1.0, <=1.3.2), @toolspack/ttd-pdfjs (>=0.0.0, <=0.1.4) potentially affected by unknown CVE via babel-laoder (0.0.1-security)

babel-laoder NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on babel-laoder and may be impacted: - @toolspack/ttd-common =0.1.0, =0.0.0, =0.1.4 Source cves: unknown CVE Source advisory: OSV:GHSA-QP6M-JQFR-2F7V...

Code Injection

pdfjs-dist is vulnerable to code injection vulnerability. This is because it does not sufficiently sanitize PostScript calculator functions which allows an attacker to inject malicious JavaScript through a crafted PDF file...

Cross-site Scripting (XSS)

Overview pdfjs-dist is a Portable Document Format PDF library that is built with HTML5. Affected versions of this package are vulnerable to Cross-site Scripting XSS. The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through...

@accoio/react-pdf-highlighter (>=2.0.0, <=2.0.1), @activelylearn/react-pdf (>=2.5.0, <=2.5.2) +118 more potentially affected by CVE-2018-5158 via pdfjs-dist (>=2.0.104, <=2.0.550)

pdfjs-dist NPM version =2.0.104, =2.0.0, =2.5.0, =1.0.32, =1.2.0, =1.0.9, =15.0.0, =6.0.0, =39.0.0, =7.0.0, =110.0.0, =7.0.0, =6.0.0, =3.0.6, =8.0.0, =9.0.0, =9.11.13 and more Source cves: CVE-2018-5158 Source advisory: SNYK:JS-PDFJSDIST-469200...