PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
Description
Published to the GitHub Advisory Database
May 7, 2024
Reviewed
May 7, 2024
Last updated
May 7, 2024
Impact
If pdf.js is used to load a malicious PDF, and PDF.js is configured with
isEvalSupported
set totrue
(which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.Patches
The patch removes the use of
eval
:mozilla/pdf.js#18015
Workarounds
Set the option
isEvalSupported
tofalse
.References
https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
References