DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-W9HM-4M3M-FXMM: GHSA-W9HM-4M3M-FXMM: Arbitrary JavaScript Execution via Malicious PDF Parsing in ngx-extended-pdf-viewer

#security #cve #cybersecurity #ghsa

GHSA-W9HM-4M3M-FXMM: Arbitrary JavaScript Execution via Malicious PDF Parsing in ngx-extended-pdf-viewer

Vulnerability ID: GHSA-W9HM-4M3M-FXMM
CVSS Score: 8.6
Published: 2026-08-06

The ngx-extended-pdf-viewer library embeds a version of Mozilla's pdf.js that contains vulnerability CVE-2026-16633. This vulnerability allows arbitrary JavaScript execution (XSS) upon rendering a malicious PDF file.

TL;DR

A high-severity Cross-Site Scripting (XSS) vulnerability exists in ngx-extended-pdf-viewer. By parsing a crafted PDF with XML Forms Architecture (XFA) elements, attackers can bypass sanitizers and execute arbitrary script inside the application context.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79 / CWE-1103
  • Attack Vector: Network
  • CVSS Score: 8.6
  • Impact: Arbitrary JavaScript Execution (XSS)
  • Exploit Status: poc
  • KEV Status: No

Affected Systems

  • ngx-extended-pdf-viewer
  • Applications incorporating vulnerable pdf.js libraries with XML Forms Architecture (XFA) enabled
  • ngx-extended-pdf-viewer: >= 27.0.0-rc.0, < 29.0.0-rc.3 (Fixed in: 29.0.0-rc.3)

Code Analysis

Commit: d5dafc3

Fix escapePDFName character padding for control codes in pdf.js core_utils.

Commit: 0aee1d5

Correct surrogate validation loops in encodeToXmlString in core_utils.

Mitigation Strategies

  • Upgrade ngx-extended-pdf-viewer to version 29.0.0-rc.3 or higher.
  • Explicitly disable XML Forms Architecture (XFA) processing in configuration.
  • Deploy restrictive Content Security Policy (CSP) headers without the 'unsafe-inline' directive.

Remediation Steps:

  1. In package.json, update 'ngx-extended-pdf-viewer' to '29.0.0-rc.3' or later.
  2. Run dependency update: npm install or yarn install.
  3. Verify that pdfDefaultOptions.enableXfa is set to false if working on unpatched deployment.
  4. Configure your web server to include 'Content-Security-Policy: default-src \'self\'; script-src \'self\';' in response headers.

References

Read the full report for GHSA-W9HM-4M3M-FXMM on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)