pdfjs-vuln-demo

Progetto Demo della Vulnerabilità PDF.js Questo progetto ha lo scopo di fungere da proof of concept per dimostrare lo sfruttamento della vulnerabilità nella libreria PDF.js pdfjs-dist segnalata in CVE-2024-4367 Per iniziare Fai il fork e clona questo repository npm install npm run dev Per testare...

pdfjs-vuln-demo

Progetto Demo Vulnerabilità PDF.js Questo progetto serve come prova di concetto per dimostrare lo sfruttamento della vulnerabilità nella libreria PDF.js pdfjs-dist riportata in CVE-2024-4367 Per Iniziare Fai il fork e clona questo repository npm install npm run dev Come Testare Prima vai su...

@0xwork/connect (0.1.8), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +1446 more potentially affected by CVE-2026-16633 via pdfjs-dist (>=5.6.205, <=6.1.200)

pdfjs-dist NPM version =5.6.205, =0.1.8-fix.3, =1.0.0, =0.2.0, =0.0.0, =0.0.11-alpha-20260329202526-cfad3bcbd829b82471d2d4fed4e49b2ef849cafb, =4.11.1, =0.0.4, =0.104.0, =0.1.0, =0.2.340, =0.1.0, =0.17.9, =0.22.4 and more Source cves: CVE-2026-16633 Source advisory: SNYK:JS-PDFJSDIST-18592344...

Cross-site Scripting (XSS)

Overview org.webjars.npm:pdfjs-dist is a Portable Document Format PDF library that is built with HTML5. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the enableScripting configuration when loading a crafted PDF file. An attacker can execute arbitrary JavaScript...

@0xwork/connect (0.1.8), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +1446 more potentially affected by CVE-2026-16633 via pdfjs-dist (>=5.6.205, <=6.1.200)

pdfjs-dist NPM version =5.6.205, =0.1.8-fix.3, =1.0.0, =0.2.0, =0.0.0, =0.0.11-alpha-20260329202526-cfad3bcbd829b82471d2d4fed4e49b2ef849cafb, =4.11.1, =0.0.4, =0.104.0, =0.1.0, =0.2.340, =0.1.0, =0.17.9, =0.22.4 and more Source cves: CVE-2026-16633 Source advisory: OSV:GHSA-HQ66-CQWQ-W95J...

NPM: PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

NPM: PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF vulnerability discovered by ? in WordPress Npm pdfjs-dist versions = 5.6.83, 6.2.108...

Cross-site Scripting (XSS)

Overview pdfjs-dist is a Portable Document Format PDF library that is built with HTML5. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the enableScripting configuration when loading a crafted PDF file. An attacker can execute arbitrary JavaScript code in the...

MAL-2026-10778 Malicious code in relativity-pdfjs-dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 542f0656a76929fa6bd11c9d8ff36f9f69c5865f46d835b8c707a803d71aa55f package.json declares a preinstall script that runs node -e inline JavaScript on npm install. The inline code collects the installer's hostname,...

Malicious code in relativity-pdfjs-dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 542f0656a76929fa6bd11c9d8ff36f9f69c5865f46d835b8c707a803d71aa55f package.json declares a preinstall script that runs node -e inline JavaScript on npm install. The inline code collects the installer's hostname,...

ROOT-APP-NPM-CVE-2024-4367 CVE-2024-4367 in @rootio/pdfjs-dist - Patched by Root

Root has patched CVE-2024-4367 in the @rootio/pdfjs-dist package for Root:npm. Multiple fixed versions available...

MAL-2026-1257 Malicious code in pdfjs-dist-fourth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcaf355459e8baaef860a557036e51431e6eb6c44dcba0e800579cf978f2f64d The package pdfjs-dist-fourth was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in pdfjs-dist-fourth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcaf355459e8baaef860a557036e51431e6eb6c44dcba0e800579cf978f2f64d The package pdfjs-dist-fourth was found to contain malicious code. Source: ossf-package-analysis...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in pdfjs-dist

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of pdfjs-dist Vulnerability Details CVEID:CVE-2024-4367 DESCRIPTION: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This...

Remote Code Execution (RCE)

pdfjs-dist is vulnerable to Remote Code Execution RCE. The vulnerability is due to the default setting isEvalSupported set to true, which allows unrestricted execution of attacker-controlled JavaScript within the hosting domain context...

@aidc/chat-ui-plugin-knowledge (>=0.5.43-beta.0, <=0.5.44), @aidc/saas-ui (>=0.5.43-beta.0, <=0.5.44) +23 more potentially affected by CVE-2024-34342 +1 more via pdfjs-dist (>=4.0.189, <=4.1.392)

pdfjs-dist NPM version =4.0.189, =0.5.43-beta.0, =0.5.43-beta.0, =0.5.43-beta.0, =0.5.43-beta.0, =0.5.43-beta.0, =8.0.0, =0.0.0-test, =1.8.4-beta.1, =0.2.1, =1.0.4, =1.6.0-dev.0-update-pdfjs-dist, =1.4.0, =1.5.1 and more Source cves: CVE-2024-34342, CVE-2024-4367 Source advisory:...

@alfresco/adf-content-services (>=2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, <=2.5.0-ffef7688d7d5b9a2827d4427d416d0b5b2f377d4), @alfresco/adf-core (>=2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, <=2.5.0-ffef7688d7d5b9a2827d4427d416d0b5b2f377d4) +200 more potentially affected by CVE-2018-5158 via pdfjs-dist (>=1.2.113, <=1.10.97)

pdfjs-dist NPM version =1.2.113, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =2.0.0-032f1237f0e7996aee56611b974f6fa6aa39fa70, =0.0.1, =1.0.0, =1.2.1, =1.0.34, =1.2.1-a, =1.0.0, =1.2.2, =0.0.7,...

@accoio/react-pdf-highlighter (>=2.0.0, <=2.0.1), @activelylearn/react-pdf (>=2.5.0, <=2.5.2) +97 more potentially affected by CVE-2018-5158 via pdfjs-dist (>=2.0.104, <=2.0.489)

pdfjs-dist NPM version =2.0.104, =2.0.0, =2.5.0, =1.0.32, =1.2.0, =15.0.0, =6.0.0, =39.0.0, =7.0.0, =110.0.0, =7.0.0, =6.0.0, =3.0.6, =8.0.0, =9.0.0, =4.0.9, =4.2.1 and more Source cves: CVE-2018-5158 Source advisory: OSV:GHSA-7JG2-JGV3-FMR4...

Code Injection

pdfjs-dist is vulnerable to code injection vulnerability. This is because it does not sufficiently sanitize PostScript calculator functions which allows an attacker to inject malicious JavaScript through a crafted PDF file...

Cross-site Scripting (XSS)

Overview pdfjs-dist is a Portable Document Format PDF library that is built with HTML5. Affected versions of this package are vulnerable to Cross-site Scripting XSS. The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through...

@accoio/react-pdf-highlighter (>=2.0.0, <=2.0.1), @activelylearn/react-pdf (>=2.5.0, <=2.5.2) +118 more potentially affected by CVE-2018-5158 via pdfjs-dist (>=2.0.104, <=2.0.550)

pdfjs-dist NPM version =2.0.104, =2.0.0, =2.5.0, =1.0.32, =1.2.0, =1.0.9, =15.0.0, =6.0.0, =39.0.0, =7.0.0, =110.0.0, =7.0.0, =6.0.0, =3.0.6, =8.0.0, =9.0.0, =9.11.13 and more Source cves: CVE-2018-5158 Source advisory: SNYK:JS-PDFJSDIST-469200...