Executive brief
Stirling-PDF is a web-based tool used for managing and editing PDF documents. A security flaw allows attackers to hide malicious code inside a PDF's metadata (like the Title or Author fields). If a user uploads or views information about such a file, the malicious code could execute in their browser, potentially allowing the attacker to steal session information or perform actions on the user's behalf.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Stirling-PDF versions prior to 2.0.0. The root cause is the failure of the /get-info-on-pdf endpoint to properly HTML-encode or sanitize the 'Title' and 'Author' metadata fields extracted from uploaded PDF files before rendering them in the browser. An attacker can exploit this by crafting a PDF with malicious JavaScript in these metadata fields. When a user interacts with the application to view the info of the crafted PDF, the script executes in the context of the user's session. This can lead to session hijacking, exfiltration of sensitive data from local storage, or DOM manipulation. The issue is resolved in version 2.0.0.
Affected products
- Stirling-Tools Stirling-PDF < 2.0.0
Timeline
- 2026-05-23: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE published to NVD
- 2023-11-25: patched: Version 2.0.0 released (based on GitHub release date)