Executive brief
Stirling-PDF is a locally hosted web application that performs various operations on PDF files, including extracting and displaying file metadata. Prior to version 2.0.0, malicious PDF files with crafted Title or Author metadata can execute malicious scripts in a user's browser when the "Get Info" button is clicked, potentially allowing attackers to steal session data, access sensitive information, or modify page content.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Get Info workflow (get-info-on-pdf.html) where untrusted PDF metadata fields are extracted and inserted directly into the DOM using innerHTML without sanitization. The vulnerable code concatenates user-controlled Title and Author metadata from PDF files and inserts the result into the summary-text element. An attacker can create a malicious PDF with XSS payloads in metadata fields; when a legitimate user uploads and clicks "Get Info" on such a PDF, the payload executes in their browser context. The attack requires user interaction (clicking Get Info) but no authentication or special privileges. This issue is fixed in version 2.0.0 via proper input sanitization.
Affected products
- Stirling-Tools Stirling-PDF <=1.1.0
Timeline
- 2026-07-30: disclosed
- 2026-11-25: patched: Version 2.0.0 released
- 2026-08-17: advisory