A high-severity CWE-79 vulnerability, identified as CVE-2026-16633 with a CVSS score of 8.6, affects PDF.js, allowing arbitrary JavaScript execution upon opening a malicious PDF via the environment template management API. This flaw enables unrestricted attacker-controlled JavaScript to be executed in the context of the hosting domain, significantly impacting business operations by compromising sensitive data and potentially leading to unauthorized actions. The vulnerability is present in versions of pdfjs-dist prior to 6.2.108, specifically within the range >= 5.6.83, < 6.2.108. To mitigate this issue, it is essential to configure PDF.js with 'enableScripting' set to false or implement a Content Security Policy (CSP) to disallow script-src.
We recommend you to update pdfjs-dist to version 6.2.108.[/subscribe_to_unlock_form]
A high-severity CWE-79 vulnerability, identified as CVE-2026-16633 with a CVSS score of 8.6, affects PDF.js, allowing arbitrary JavaScript execution upon opening a malicious PDF via the environment template management API. This flaw enables unrestricted attacker-controlled JavaScript to be executed in the context of the hosting domain, significantly impacting business operations by compromising sensitive data and potentially leading to unauthorized actions. The vulnerability is present in versions of pdfjs-dist prior to 6.2.108, specifically within the range >= 5.6.83, < 6.2.108. To mitigate this issue, it is essential to configure PDF.js with 'enableScripting' set to false or implement a Content Security Policy (CSP) to disallow script-src.
We recommend you to update pdfjs-dist to version 6.2.108.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]