Skip to content
OpenAdvisories

Package · npm

pdfjs-dist

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High —
    CVE-2026-16633

    PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

    ### Impact If PDF.js is used to load a malicious PDF, and PDF.js is configured with `enableScripting` set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context o…

    pdfjs-dist npm
  • Medium 5.6
    CVE-2024-4367 Public exploit EPSS 71%

    PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

    A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu npm
  • High 8.8
    CVE-2018-5158 Public exploit EPSS 10%

    Malicious PDF can inject JavaScript into PDF Viewer

    The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability af…

    Mozilla Firefox Firefox ESR firefox Browsers Debian Ubuntu npm