PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

published 2026-08-06 3mo ago modified 2026-09-10 last mo. also GHSA-hq66-cqwq-w95j

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no EPSS score yet
public exploits: 0; none known

### Impact

If PDF.js is used to load a malicious PDF, and PDF.js is configured with `enableScripting` set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

### Patches

### Workarounds Set `enableScripting` to `false` or set a CSP.

Patch / fix

fixed in 1

npm pdfjs-dist 6.2.108

Is CVE-2026-16633 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
npm	pdfjs-dist	>=5.6.83, <6.2.108	6.2.108

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

GitHub Advisory GHSA-hq66-cqwq-w95j

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.