pdfjs-vuln-demo

PDF.js Vulnerability Demo Project This project is intended to serve as a proof of concept to demonstrate exploiting the vulnerability in the PDF.js pdfjs-dist library reported in CVE-2024-4367 Getting Things Running Fork and clone from this repository npm install npm run dev Testing Things Out...

ROOT-APP-NPM-AIKIDO-2026-169371 AIKIDO-2026-169371 in pdfjs-dist - Patched by Root

Root has patched AIKIDO-2026-169371 in the pdfjs-dist package for Root:npm. Multiple fixed versions available...

pdfjs-vuln-demo

PDF.js 漏洞演示项目 本项目旨在作为概念验证（PoC），演示如何利用 CVE-2024-4367 中所报告的 PDF.js（pdfjs-dist）库漏洞。 运行项目 从本仓库 Fork 并克隆 npm install npm run dev 进行测试 首先访问 http://localhost:4321/ 通过点击对应的卡片，选择你想要测试的前端框架组件（react、vue、svelte） 确保示例 PDF（未利用漏洞）能够正常加载 你可以在 /public 目录中找到并分析所有示例 PDF。每个 PDF 都尝试演示利用该漏洞的不同方式。 准备好测试真正利用该漏洞的 PDF...

PDFJS

PDFJS...

ROOT-APP-NPM-CVE-2024-4367 CVE-2024-4367 in pdfjs-dist - Patched by Root

Root has patched CVE-2024-4367 in the pdfjs-dist package for Root:npm. Multiple fixed versions available...

NPM: ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

NPM: ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633 vulnerability discovered by ? in WordPress Npm ngx-extended-pdf-viewer versions = 27.0.0-rc.0, 29.0.0-rc.3...

@0xwork/connect (0.1.8), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +1432 more potentially affected by CVE-2026-16633 via pdfjs-dist (>=5.6.205, <=6.1.200)

pdfjs-dist NPM version =5.6.205, =0.1.8-fix.3, =1.0.0, =0.2.0, =0.0.0, =0.1.0, =0.0.11-alpha-20260329202526-cfad3bcbd829b82471d2d4fed4e49b2ef849cafb, =4.11.1, =0.0.4, =0.0.0-beta-20260819155526, =0.0.0-beta-20260820202238, =0.0.0-beta-20260819155526, =0.1.0, =0.1.1 and more Source cves:...

@0xwork/connect (0.1.8), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +1432 more potentially affected by CVE-2026-16633 via pdfjs-dist (>=5.6.205, <=6.1.200)

pdfjs-dist NPM version =5.6.205, =0.1.8-fix.3, =1.0.0, =0.2.0, =0.0.0, =0.1.0, =0.0.11-alpha-20260329202526-cfad3bcbd829b82471d2d4fed4e49b2ef849cafb, =4.11.1, =0.0.4, =0.0.0-beta-20260819155526, =0.0.0-beta-20260820202238, =0.0.0-beta-20260819155526, =0.1.0, =0.1.1 and more Source cves:...

Cross-site Scripting (XSS)

Overview org.webjars.npm:pdfjs-dist is a Portable Document Format PDF library that is built with HTML5. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the enableScripting configuration when loading a crafted PDF file. An attacker can execute arbitrary JavaScript...

NPM: PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

NPM: PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF vulnerability discovered by ? in WordPress Npm pdfjs-dist versions = 5.6.83, 6.2.108...

Cross-site Scripting (XSS)

Overview pdfjs-dist is a Portable Document Format PDF library that is built with HTML5. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the enableScripting configuration when loading a crafted PDF file. An attacker can execute arbitrary JavaScript code in the...

CLSA-2026-1775089656 TuxCare security update for pdfjs-dist (1 CVE)

TuxCare rebuilt pdfjs-dist to address 1 CVE. Fixed in 3.11.174-tuxcare.1...

MAL-2026-10778 Malicious code in relativity-pdfjs-dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 542f0656a76929fa6bd11c9d8ff36f9f69c5865f46d835b8c707a803d71aa55f package.json declares a preinstall script that runs node -e inline JavaScript on npm install. The inline code collects the installer's hostname,...

Malicious code in relativity-pdfjs-dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 542f0656a76929fa6bd11c9d8ff36f9f69c5865f46d835b8c707a803d71aa55f package.json declares a preinstall script that runs node -e inline JavaScript on npm install. The inline code collects the installer's hostname,...

MAL-2026-1257 Malicious code in pdfjs-dist-fourth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcaf355459e8baaef860a557036e51431e6eb6c44dcba0e800579cf978f2f64d The package pdfjs-dist-fourth was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in pdfjs-dist-fourth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcaf355459e8baaef860a557036e51431e6eb6c44dcba0e800579cf978f2f64d The package pdfjs-dist-fourth was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-1216 Malicious code in pdfjs-dist-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5827ccd19d073818da31059d76a725b171d1fc793a4f2591ed0118a35b46c35 The package pdfjs-dist-v5 was found to contain malicious code. Source: ossf-package-analysis...

Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in pdfjs-dist-2.4.456.tgz

Summary Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in pdfjs-dist-2.4.456.tgz Vulnerability Details CVEID:CVE-2024-4367 DESCRIPTION: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js...

@toolspack/ttd-common (>=0.1.0, <=1.3.2), @toolspack/ttd-pdfjs (>=0.0.0, <=0.1.4) potentially affected by unknown CVE via babel-laoder (0.0.1-security)

babel-laoder NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on babel-laoder and may be impacted: - @toolspack/ttd-common =0.1.0, =0.0.0, =0.1.4 Source cves: unknown CVE Source advisory: OSV:MAL-2025-15281...

SUSE CVE-2025-47943

Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting XSS vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usage of a vulnerable and outdated componen...