Executive brief
ngx-extended-pdf-viewer, a library used to display PDF documents in web applications, is vulnerable to a security flaw inherited from an embedded version of Mozilla's pdf.js. If a user opens a specially crafted malicious PDF file, an attacker could execute unauthorized code within the user's web browser. This could lead to the theft of sensitive session information or unauthorized actions performed on behalf of the user.
Technical details
ngx-extended-pdf-viewer bundles a fork of Mozilla's pdf.js that is vulnerable to CVE-2026-16633. The vulnerability allows for arbitrary JavaScript execution in the context of the hosting page when a malicious PDF is opened. The primary attack vector in this library involves XFA (XML Forms Architecture) rich text processing, which is enabled by default (enableXfa = true). While the library disables scripting by default, the XFA-based vector remains reachable. A fix has been cherry-picked from pdf.js 6.2.108 into ngx-extended-pdf-viewer version 29.0.0-rc.3.
Affected products
- stephanrauh ngx-extended-pdf-viewer >= 27.0.0-rc.0, < 29.0.0-rc.3
Timeline
- 2026-07-30: disclosed: Initial disclosure by developer
- 2026-08-06: advisory: GitHub Advisory published
- 2026-08-06: patched: Version 29.0.0-rc.3 released with fix