| Package | Affected versions | Patched versions |
|---|---|---|
| pdfjs-dist | ≥ 5.6.83, < 6.2.108 | 6.2.108 |
If PDF.js is used to load a malicious PDF, and PDF.js is configured with enableScripting set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.
Set enableScripting to false or set a CSP.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free