Arbitrary Code Injection Affecting pdfjs-dist package, versions <4.2.67
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (12th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-PDFJSDIST-6810403
- published 7 May 2024
- disclosed 7 May 2024
- credit ThomasRinsma
How to fix?
Upgrade pdfjs-dist to version 4.2.67 or higher.
Overview
pdfjs-dist is a Portable Document Format (PDF) library that is built with HTML5.
Affected versions of this package are vulnerable to Arbitrary Code Injection in font_loader.js, which passes input to the eval() function when the default isEvalSupported option is in use. An attacker can execute code by convincing a user to open a malicious PDF file.
Workaround
This vulnerability can be avoided by setting isEvalSupported to false.
References
CVSS Scores
version 3.1