Executive brief
ngx-extended-pdf-viewer is an Angular library for displaying PDF files in web applications. It embeds a forked version of Mozilla's pdf.js that contains a code execution vulnerability. Opening a malicious PDF file can allow an attacker to execute arbitrary JavaScript within the web page, potentially compromising user data, session tokens, and application functionality.
Technical details
The vulnerability stems from improper handling of XFA (XML Forms Architecture) rich text in the embedded pdf.js fork, specifically CVE-2026-16633. The XFA processing allows attacker-controlled JavaScript execution in the hosting page context. While the library disables enableScripting by default (reducing exposure compared to upstream pdf.js), XFA processing is enabled by default via enableXfa: true, making systems vulnerable by default. The attack requires only that a user open a crafted PDF file; no additional interaction beyond the default configuration is needed. Mozilla's fix is backported in versions 29.0.0-rc.3 and 28.1.1. The vulnerability is not easily detected by dependency scanners since ngx-extended-pdf-viewer embeds pdf.js as source code rather than depending on the pdfjs-dist package.
Affected products
- Stephan Rauh ngx-extended-pdf-viewer >=27.0.0-rc.0, <28.1.1 and >=29.0.0-rc.0, <29.0.0-rc.3
Timeline
- 2026-08-06: disclosed
- 2026-08-06: patched: Patches available in 28.1.1 and 29.0.0-rc.3