Cross-Site Scripting (XSS)

PDF.js is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to PDF.js allowing JavaScript embedded in a malicious PDF to execute when enableScripting is enabled and no restrictive script-src CSP is configured, which allows an attacker to craft and load a malicious PDF to execute...

Cross-site Scripting (XSS)

Overview pdfjs-dist is a Portable Document Format PDF library that is built with HTML5. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the enableScripting configuration when loading a crafted PDF file. An attacker can execute arbitrary JavaScript code in the...

Cross-site Scripting (XSS)

Overview org.webjars.npm:pdfjs-dist is a Portable Document Format PDF library that is built with HTML5. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the enableScripting configuration when loading a crafted PDF file. An attacker can execute arbitrary JavaScript...

PT-2026-68965

Impact If PDF.js is used to load a malicious PDF, and PDF.js is configured with enableScripting set to true which is the default value and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. Patches Workarounds Set...

PT-2026-69021

Name of the Vulnerable Software and Affected Versions pdfjs-dist affected versions not specified Description When enableScripting is set to true and no Content Security Policy CSP is configured to disallow script-src, loading a malicious PDF can lead to the execution of unrestricted...