Executive brief
PDF.js is a widely used library for displaying PDF documents within web browsers. A vulnerability has been identified where opening a specially crafted PDF file can allow an attacker to execute malicious code in the user's browser. This could lead to the theft of sensitive information, such as login session tokens, or unauthorized actions performed on behalf of the user on the website hosting the PDF viewer.
Technical details
A cross-site scripting (XSS) vulnerability exists in PDF.js (specifically the pdfjs-dist npm package) due to improper neutralization of input during PDF rendering. When the 'enableScripting' configuration is set to true (the default) and a Content Security Policy (CSP) does not explicitly disallow 'script-src', a malicious PDF can trigger the execution of arbitrary JavaScript in the context of the hosting domain. The attack requires a user to open the malicious PDF file. This issue is tracked as CVE-2026-16633 and is resolved in version 6.2.108. As a workaround, administrators can set 'enableScripting' to false or implement a strict CSP.
Affected products
- Mozilla pdfjs-dist >= 5.6.83, < 6.2.108
Timeline
- 2026-07-28: disclosed: Vulnerability reported to Mozilla
- 2026-08-06: advisory: GitHub Advisory published
- 2026-08-06: patched: Fix released in version 6.2.108