Listen to this Post
CVE-2026-16633 is a vulnerability in Mozilla’s pdf.js library that allows arbitrary JavaScript execution when processing a malicious PDF. The issue stems from improper neutralization of active content in PDF scripting support. Two distinct vectors exist: the first requires `enableScripting` to be true (pdf.js default), while the second involves XFA (XML Forms Architecture) rich text and is reachable whenever `enableXfa` is true.
ngx-extended-pdf-viewer embeds a fork of Mozilla’s pdf.js rather than depending on pdfjs-dist. This means the vulnerability is not visible to dependency scanners through package.json. The embedded pdf.js version contains the flaw, but scanners looking at the npm dependency tree will not flag it.
The library’s default configuration partially mitigates exposure: `enableScripting` is disabled by default, unlike upstream pdf.js. However, `enableXfa` is enabled by default, making the XFA vector reachable out-of-the-box. Attackers can craft a PDF with malicious XFA elements that bypass sanitizers and execute script in the hosting page’s context.
The fix is cherry-picked from Mozilla’s pdf.js 6.2.108 into ngx-extended-pdf-viewer 29.0.0-rc.3. Only the latest release receives security updates. From version 29.0.0, the package ships `sbom.json` and `vex.json` to help scanners detect the fix. The SBOM records the applied fix as a CycloneDX `pedigree.patches` entry; the VEX carries a `resolved_with_pedigree` statement.
DailyCVE Form:
Platform: Angular
Version: >=27.0.0-rc.0,<29.0.0-rc.3
Vulnerability: XSS (Arbitrary JS)
Severity: High (CVSS 8.6)
date: 2026-08-06
Prediction: 2026-08-10
What Undercode Say:
Check installed version npm list ngx-extended-pdf-viewer Verify SBOM presence (29.0.0+) cat node_modules/ngx-extended-pdf-viewer/sbom.json | grep -A5 "CVE-2026-16633" Check VEX statement cat node_modules/ngx-extended-pdf-viewer/vex.json | grep -A5 "resolved_with_pedigree"
// Verify enableXfa setting at runtime console.log(pdfDefaultOptions.enableXfa); // Should be false if workaround applied // Check pdf.js engine version (bundled) // Look for pdf.js version string in console or network tab
Exploit:
A remote attacker supplies a specially crafted PDF containing malicious XFA rich text elements. When the application renders this PDF, the XFA sanitizers are bypassed, allowing attacker-controlled JavaScript to execute in the context of the hosting domain. The exploit requires no user interaction beyond opening the PDF.
Protection:
1. Upgrade to `[email protected]` or later
- Disable XFA if not needed: `pdfDefaultOptions.enableXfa = false`
3. Apply CSP disallowing `unsafe-inline` in `script-src`
- Verify SBOM/VEX from 29.0.0+ to confirm fix application
Impact:
Opening a malicious PDF can execute attacker-controlled JavaScript in the context of the hosting page. This enables cross-site scripting (XSS) attacks, potentially leading to session hijacking, data theft, or arbitrary actions performed on behalf of the user. The vulnerability is high severity (CVSS 8.6) and has a public proof of concept available.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
