{"id":"GHSA-87hq-q4gp-9wr4","summary":"react-pdf vulnerable to arbitrary JavaScript execution upon opening a malicious PDF with PDF.js","details":"### Summary\n\nIf PDF.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.\n\n### Patches\n[This patch](https://github.com/wojtekmaj/react-pdf/commit/671e6eaa2e373e404040c13cc6b668fe39839cad) forces `isEvalSupported` to `false`, removing the attack vector.\n\n### Workarounds\nSet `options.isEvalSupported` to `false`, where `options` is `Document` component prop.\n\n### References\n- [GHSA-wgrm-67xf-hhpq](https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq)\n- https://github.com/mozilla/pdf.js/pull/18015\n- https://github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6\n- https://bugzilla.mozilla.org/show_bug.cgi?id=1893645","aliases":["CVE-2024-34342"],"modified":"2026-02-04T02:26:44.613595Z","published":"2024-05-07T16:48:59Z","related":["CVE-2024-34342"],"database_specific":{"nvd_published_at":"2024-05-07T15:15:09Z","severity":"HIGH","cwe_ids":["CWE-79"],"github_reviewed_at":"2024-05-07T16:48:59Z","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq"},{"type":"WEB","url":"https://github.com/wojtekmaj/react-pdf/security/advisories/GHSA-87hq-q4gp-9wr4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34342"},{"type":"WEB","url":"https://github.com/mozilla/pdf.js/pull/18015"},{"type":"WEB","url":"https://github.com/mozilla/pdf.js/commit/85e64b5c16c9aaef738f421733c12911a441cec6"},{"type":"WEB","url":"https://github.com/wojtekmaj/react-pdf/commit/208f28dd47fe38c33ce4bac4205b2b0a0bb207fe"},{"type":"WEB","url":"https://github.com/wojtekmaj/react-pdf/commit/671e6eaa2e373e404040c13cc6b668fe39839cad"},{"type":"PACKAGE","url":"https://github.com/wojtekmaj/react-pdf"}],"affected":[{"package":{"name":"react-pdf","ecosystem":"npm","purl":"pkg:npm/react-pdf"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.7.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-87hq-q4gp-9wr4/GHSA-87hq-q4gp-9wr4.json"}},{"package":{"name":"react-pdf","ecosystem":"npm","purl":"pkg:npm/react-pdf"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-87hq-q4gp-9wr4/GHSA-87hq-q4gp-9wr4.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"}]}