You open a PDF in your browser, there's a terminal inside, and you can run commands.
Adobe's spec supports JavaScript execution.
If the viewer implements it, JS code embedded in a PDF can run.
So a PDF isn't just a document; it can actually be used as a runtime environment too.
This feature has been actively used in PDF-based attacks for years.
linuxpdf exploits exactly this.
Ading2210 compiled the Linux kernel to WebAssembly using Emscripten.
The resulting WASM binary is embedded inside the PDF.
When the PDF opens, the JavaScript engine runs this WASM and you see a terminal.
ls, cat, echo
Commands like these work.
A real shell experience.
Of course, it has its limitations too. Not every PDF viewer can open it because not all of them support JS execution.
Chrome's built-in viewer behaves in an isolated way and its WASM support isn't complete.
Chromium or Firefox is recommended for the demo.
There's also the performance issue. Every keystroke goes through the WASM runtime, so it can't be as fast as a real terminal.
From a security perspective, what the project demonstrates matters.
PDFs being able to run JavaScript is an old risk, but once it reaches the level of "a full operating system can run inside this", it looks different, of course.
In practice, it can be a good reference point for thinking about how sophisticated a malicious PDF can get.
The project's source code is available on GitHub. The demo PDF opens in the browser without downloading.
Source:
https://github.com/ading2210/linuxpdf
Demo:
https://linux.doompdf.dev/
Originally written in Turkish on eminuzun.com. AI was used only for the translation.
Top comments (0)