Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:46793
HistoryMay 08, 2024 - 4:43 a.m.

Remote Code Execution (RCE)

2024-05-0804:43:35
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
31
pdfjs-dist
vulnerability
remote code execution
rce
default setting
isevalsupported

7.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.4%

pdfjs-dist is vulnerable to Remote Code Execution (RCE). The vulnerability is due to the default setting isEvalSupported set to true, which allows unrestricted execution of attacker-controlled JavaScript within the hosting domain context.