Reflected cross-site scripting (XSS) In pdfjs-dist
Description
PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF
Impact
If PDF.js is used to load a malicious PDF, and PDF.js is configured with enableScripting set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.
Workarounds
Set enableScripting to false or set a CSP.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 npm | 6.2.108 |
Aliases
1. 2. 3. 4. 5.
References
1. 2.