7 matches found
CVE-2024-34342
react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true which is the default value, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in...
@boxwood-connor/react-doc-viewer (>=1.0.1, <=1.0.2), @bty/business-components (>=1.0.2, <=1.0.4) +65 more potentially affected by CVE-2024-34342 via react-pdf (>=7.1.2, <=7.7.1)
react-pdf NPM version =7.1.2, =1.0.1, =1.0.2, =0.2.70, =0.2.57, =0.1.2-1.beta-1, =0.0.8, =0.3.21, =0.0.1, =1.14.0, =1.0.13, =1.1.0, =0.1.10, =0.0.16-8.14204.alpha.1, =0.0.182-alpha.30184.1 and more Source cves: CVE-2024-34342 Source advisory: OSV:GHSA-87HQ-Q4GP-9WR4...
CVE-2024-34342 react-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true which is the default value, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in...
CVE-2024-34342 react-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true which is the default value, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in...
CVE-2024-34342
This CVE affects the react-pdf library (PDF.js integration). When PDF.js loads a malicious PDF and isEvalSupported is true (default), attacker-controlled JavaScript can run in the hosting domain’s context. The vulnerability is fixed in PDF.js when updated to versions 7.7.3 or 8.0.2, and react-pdf...
CVE-2024-34342 react-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true which is the default value, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in...
@aidc/chat-ui-plugin-knowledge (>=0.5.43-beta.0, <=0.5.44), @aidc/saas-ui (>=0.5.43-beta.0, <=0.5.44) +23 more potentially affected by CVE-2024-34342 +1 more via pdfjs-dist (>=4.0.189, <=4.1.392)
pdfjs-dist NPM version =4.0.189, =0.5.43-beta.0, =0.5.43-beta.0, =0.5.43-beta.0, =0.5.43-beta.0, =0.5.43-beta.0, =8.0.0, =0.0.0-test, =1.8.4-beta.1, =0.2.1, =1.0.4, =1.6.0-dev.0-update-pdfjs-dist, =1.4.0, =1.5.1 and more Source cves: CVE-2024-34342, CVE-2024-4367 Source advisory:...