PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

HOCH 8.8CVE-2024-4367 · GHSA-wgrm-67xf-hhpq · Published 14/05/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
firefox mozilla	`< 115.11.0< 126.0`	`115.11.0126.0`
thunderbird mozilla	`< 115.11.0`	`115.11.0`
open-xchange appsuite frontend open-xchange	`= 7.10.6< 7.10.6`	`7.10.6`
pdfjs-dist npm	`< 4.2.67`	`4.2.67`

Description

Impact

If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

Patches

The patch removes the use of eval: https://github.com/mozilla/pdf.js/pull/18015

Workarounds

Set the option isEvalSupported to false.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1893645

NVD description

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

References

mozilla/pdf.js security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-4367 · ADVISORY
gogs/gogs · WEB
mozilla/pdf.js#18015 · WEB
mozilla/pdf.js commit 85e64b5 · WEB
bugzilla.mozilla.org/show_bug.cgi · WEB
cert-portal.siemens.com/productcert/html/ssa-827383.html · WEB
codeanlabs.com/blog/research/cve-2024-4367-arbitrary-js-execution-in-pdf-js · WEB
mozilla/pdf.js · PACKAGE
mozilla/pdf.js release v4.2.67 · WEB
lists.debian.org/debian-lts-announce/2024/05/msg00010.html · WEB
lists.debian.org/debian-lts-announce/2024/05/msg00012.html

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free