SB2026072917 - Code Injection in PDF.js

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072917

SB2026072917 - Code Injection in PDF.js

Published: July 29, 2026

Security Bulletin ID SB2026072917
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Code Injection (CVE-ID: CVE-2026-16633)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary JavaScript in the context of the hosting domain.

The vulnerability exists due to improper neutralization of active content in PDF scripting support in PDF.js when processing a malicious PDF with scripting enabled. A remote attacker can supply a specially crafted PDF to execute arbitrary JavaScript in the context of the hosting domain.

Exploitation requires the application to load the crafted PDF with enableScripting set to true and without a content security policy that disallows script sources.


Remediation

Install update from vendor's website.

References