Homepage
About Snyk

react-pdf@3.0.0-alpha vulnerabilities

Display PDFs in your React app as easily as if they were images.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the react-pdf package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Arbitrary Code Injection

react-pdf is a package used to display existing PDFs.

Affected versions of this package are vulnerable to Arbitrary Code Injection via the isEvalSupported configuration parameter. An attacker can execute code by convincing a user to open a malicious PDF file. This is only exploitable if isEvalSupported is set to true, which is the default setting.

How to fix Arbitrary Code Injection?

Upgrade react-pdf to version 7.7.3, 8.0.2 or higher.

<7.7.3 >=8.0.0 <8.0.2
Go back to all versions of this package